4 ms·
How is that false? Name a single example where SMS 2FA is worse than none. And just because it will always come up: 2FA, not treating the second factor as only
by Semaphor 4y ago
How is that false? Name a single example where SMS 2FA is worse than none. And just because it will always come up: 2FA, not treating the second factor as only factor.
- mellavora 4y agowhen your sim gets hijacked and someone steals your entire bitcoin wallet? worse than none because it "justifies" being sloppy with the first factor (i.e. account password).
- Semaphor 4y agoOkay, I guess if you stretch that hard you can reach your goal. edit: Your first sentence is meaningless because that is just as stolen with no 2FA.
- jjav 4y ago> Name a single example where SMS 2FA is worse than none. SMS is terrible because it is so easy to lose account access. Phone broken/stolen? Completely locked out. Or, I have this one financial institution that insists on sending SMS 2FA to the phone number on file, which is a 20+ year old landline which obviously can't receive SMS. Completely locked out. Someday I'll have to find out some way to get my money out of there (they have no local branches). I will always use TOTP if at all possible, because it's not a single point of failure. I store the seed values securely and they are backed up, so can't be lost.
- Semaphor 4y agoThat is actually a good point. Hadn’t thought of that. I hate TOTP, can handle SMS 2FA (sim-swapping is super rare here) and love FIDO/U2F/Webauthn (or whatever it’s called today). I have one with NFC on my keychain, and a backup device in the drawer. No off-site backup key, but encrypted backup codes.