4 ms·
You have many options including notifications in google apps, authenticator apps, text messages, hardware tokens, written backup codes. Not all of these rely on
by r0m4n0 5y ago
You have many options including notifications in google apps, authenticator apps, text messages, hardware tokens, written backup codes. Not all of these rely on your phone so set them all up
- KennyBlanken 5y agoSo in other words dramatically increase the attack surface on my account. Enabling SMS authentication for an account is a huge DOWNGRADE in security, not an increase. Cellular providers are infamously easy to socially engineer.
- iszomer 5y agoEspecially some banks that still use SMS as your 2FA.
- r0m4n0 5y agoNo… Well I guess if you were adding SMS as a 2fa option to your real 2fa would increase surface but that wouldn’t solve what the parent comment was saying. So yea don’t do that (but it’s better than just a password). 1)Password alone is weak. 2)Password and SMS 2fa better. 3)Password and real 2fa best. 4)Password, real 2fa, backup codes, basically just as good as best. Google is only eliminating #1, and only requires 2fa when logging into a new device. I’m surprised HN folks are having a tough time grasping this one, in general it’s pushing people (I’d guess 90% of people would never opt into anything more than a regular password, including the parent) into #2 above. Parent should do #4, but #2 is fine