3 ms·
> Providers have been known to reset accounts with just SMS 2FA But this turns the 2FA into 1FA, and that "1" is just an SMS. Using SMS as a second factor is
by ajsnigrutin 5y ago
> Providers have been known to reset accounts with just SMS 2FA
But this turns the 2FA into 1FA, and that "1" is just an SMS.
Using SMS as a second factor is great, using it as an only one, is not.
If someone hacks eg linkedin (again), and gets all the passwords, they can just hack literally millions of accounts on other services just because of password reuse. SMS 2FA prevents that very effectively.
But I agree that companies use things made to deal with "issue A" to deal with "issue B", even if the thing is totally inappropriate for "issue B". I've heard from people that some places in USA use SSN, date of birth, mothers maiden name, etc. to authenticate and verify the user (instead of doing stuff in person with an ID card)... most of those things are (almost) impossible to change, and once someone knows them, you're fscked. Same with fingerprints as means of authentication... once someone makes a mould, you're done, because they can use them, and you can't change them.
- stavros 5y ago> But this turns the 2FA into 1FA, and that "1" is just an SMS. Sure, but the fact that an explanation exists is unlikely to be of help if you get your account compromised by this. > If someone hacks eg linkedin (again), and gets all the passwords, they can just hack literally millions of accounts on other services just because of password reuse. SMS 2FA prevents that very effectively. Hacking a specific service is much harder than simjacking. Use an alternate method of 2FA (a FIDO2 USB key would be best).
- ajsnigrutin 5y ago> Hacking a specific service is much harder than simjacking. Use an alternate method of 2FA (a FIDO2 USB key would be best). If you have someones linkedin email+password, how is it hard to "hack" into their facebook account, if they use the same email+password combo there?
- stavros 5y agoIf you have someone's credentials for a service, it is easy to use them to log in to that service, no matter what they used for authentication. Moving the goalposts until only your argument is valid is nice if you like to be tautologically correct, but is not very useful.
- ineedasername 5y agoI agree about FIDO2 USB keys. As a matter of practice though, what happens if you lose the key?
- stavros 5y agoPersonally, I just have multiple. I also enroll my devices (phone, laptop), so there's a good bit of redundancy.
- tialaramex 5y agoImmediately? You need to find some other way to prove you're still you. Many sites which enable WebAuthn have a pile of single use random text codes you can use to do this, write at least a few down somewhere safe. The specification for WebAuthn (and presumably U2F but that's legacy and shouldn't be used for green field deployments) explicitly tells Relying Parties (that'd be the web site you're enrolling with) to allow multiple authenticators to be enrolled† They are keys after all, so it probably feels reasonable to have a key you're carrying and one spare at home. Maybe if you lose your keys a lot, buy three just in case. Unless you've got a FIDO2 device (not just FIDO) enrolled for usernameless authentication, the device doesn't even know who you are. So if you lost it on the train, or at a crowded event, relax, even if somebody found it intact and is curious the device can't help them log in as you since it doesn't even tell its new owner who you are. In fact it actually works perfectly well for them too, to secure their Facebook or whatever, in this way it's more like if you lose a quarter than if you lose your car keys. † Now somebody will point out that AWS doesn't do this, and somehow this fact will be a justification for why an entire technology is bad, rather than yet another shortcoming of AWS...