3 ms·
Um, Google’s ulterior motives aside, how is it less secure to require a physical artifact in order to authenticate? SMS may not be the most secure channel ever,
by Sharlin 5y ago
Um, Google’s ulterior motives aside, how is it less secure to require a physical artifact in order to authenticate? SMS may not be the most secure channel ever, and SIM swap scamming is a thing, but seems to me that breaking even SMS-based 2FA requires quite a lot of effort per victim.
- idiotsecant 5y agoIf I want your account and you have SMS based password reset I can do some social engineering and get in in a couple hours (if multiple tries required). If I want your account and there is no SMS password reset I'm done unless I have previously compromised your backup email.
- Sharlin 5y agoBut SMS reset here stands opposed to other, less secure reset mechanisms, because more people have a phone number than a backup email account (especially that they can reliably access).
- noduerme 5y agoAuthenticator apps require a physical device, but not a phone number. That's what I mean: They don't need your phone number for any reason, and any 2FA based on the number is insecure.