4 ms·

You’re talking about a completely different thing, SMS for password reset. That’s completely distinct from SMS as a second factor for logging in, which is absol

You’re talking about a completely different thing, SMS for password reset. That’s completely distinct from SMS as a second factor for logging in, which is absolutely fine for almost all people’s threat models, even in places where SIM or telco attacks are feasible, since the SIM alone is insufficient to log in as you. Sure, it’s common for sites to use your phone number both for 2FA and account recovery (whether single- or multi-factor—and single-factor account recovery is obviously a serious problem in a two-factor authentication environment), but the problem you’re complaining about is nothing to do with 2FA. I think Fastmail hits the right balance, and explains it well: https://www.fastmail.help/hc/en-us/articles/360058752374-Using-two-step-verification-2FA- https://www.fastmail.help/hc/en-us/articles/360058752374-Usi..., heading “Why do I have to add a recovery phone number to set up two-step verification?”

MattPalmer1086 5y ago
If an attacker can get a SIM for your number, SMS 2fa is useless. They will get the second factor by text message just as you would.
- jeromegv 5y ago
  But they need your password first. So you’re not in a worse position than if you didn’t have 2FA. Parent was implying 2FA made it worse.
- chrismorgan 5y ago
  They still need your password. The SMS alone is insufficient. Supporting SMS as a second factor (whether primary or backup) is perfectly adequate for almost everyone’s threat model, and generally far superior to not supporting it as regards avoiding account lockout. (That’s Fastmail’s position, which I thoroughly agree with.)
  - MattPalmer1086 5y ago
    I agree it's probably better than nothing for many people. It's still pretty much the worst form of 2fa there is, and not nearly as secure as people assume.
- blfr 5y ago
  It's not useless. It forces the attacker to expand all the effort to get a SIM for your number. While certainly possible, it's not that easy.
  - MattPalmer1086 5y ago
    I said it's useless if an attacker can get access to a SIM (or hack the SS7 protocol, or whatever). Clearly it's an extra bar for an attacker, no disagreement there.

MattPalmer1086 5y ago

If an attacker can get a SIM for your number, SMS 2fa is useless. They will get the second factor by text message just as you would.

jeromegv 5y ago
But they need your password first. So you’re not in a worse position than if you didn’t have 2FA. Parent was implying 2FA made it worse.
chrismorgan 5y ago
They still need your password. The SMS alone is insufficient. Supporting SMS as a second factor (whether primary or backup) is perfectly adequate for almost everyone’s threat model, and generally far superior to not supporting it as regards avoiding account lockout. (That’s Fastmail’s position, which I thoroughly agree with.)
- MattPalmer1086 5y ago
  I agree it's probably better than nothing for many people. It's still pretty much the worst form of 2fa there is, and not nearly as secure as people assume.
blfr 5y ago
It's not useless. It forces the attacker to expand all the effort to get a SIM for your number. While certainly possible, it's not that easy.
- MattPalmer1086 5y ago
  I said it's useless if an attacker can get access to a SIM (or hack the SS7 protocol, or whatever). Clearly it's an extra bar for an attacker, no disagreement there.