4 ms·
Bingo. Which is why the second factor in 2 factor authentication is "something you have". It's also why SMS text messages do not meet the criteria for 2 fact
by EricE 5y ago
Bingo.
Which is why the second factor in 2 factor authentication is "something you have".
It's also why SMS text messages do not meet the criteria for 2 factor authentication - it's trivial to social engineer phone companies into moving a phone number to a new phone - presumably one you would not have. Authentication apps are a PITA to move to new devices because having a way to move your keys around without some reliance on meatspace defeats the whole goal of "something you have".
- selfhoster11 5y ago> it's trivial to social engineer phone companies into moving a phone number to a new phone Obligatory "if you're in the US, then yes - elsewhere, it depends". In the UK, obtaining a PAC code is a bit more complicated/non-trivial for the attacker. I'd consider it fairly safe to use SMS 2FA over here.