3 ms·
> So it's better to not consider that information at all? Exactly > What is better? (1) Requiring a password to login or (2) Requiring a password and a code s
by staticassertion 5y ago
> So it's better to not consider that information at all?
Exactly
> What is better? (1) Requiring a password to login or (2) Requiring a password and a code sent via SMS?
They're equivalent in my mind - SMS is such a weak 2FA mechanism, and it's so easy to get wrong and have it decrease your overall security, any benefit is lost. Rather than pushing SMS because it's what we have we should make greater efforts to leverage technology that we know is considerably better in every regard except availability today - IMO that is the problem to solve.