4 ms·
"What's the alternative? SMS 2FA is abysmal." It seems to be forgotten that email 2FA exists. I can't quantify the risks relative to SMS 2FA because there are
by rsync 4y ago
"What's the alternative? SMS 2FA is abysmal."
It seems to be forgotten that email 2FA exists.
I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ?
There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.
- daveoc64 4y agoThe main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails). Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.
- wlecometo 4y agoif someone gets access to your phone they can do way more damage, but this is accepted.
- jamal-kumar 4y agoIt's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale