3 ms·
Agreed. If you use a password manager to generate a high-entropy password, come up with similarly-secure answers to the “security questions”, and make sure you
by joshspankit 4y ago
Agreed.
If you use a password manager to generate a high-entropy password, come up with similarly-secure answers to the “security questions”, and make sure your email is also secure, then SMS 2FA is a significant downgrade to your overall security.
- lxgr 4y agoNote that using SMS-OTP as a second factor besides the password/security questions, 2FA is never a downgrade, but using SMS-OTP as a single recovery factor (for a forgotten password) definitely is. Only the latter is a problem.
- joshspankit 4y agoIt’s still a downgrade because it’s an avenue for social engineering the customer service/support reps