3 ms·
USA banks seem to have found the 2fa powerpoint presentation and are forcing accounts to use SMS 2fa, with no ability to use something like authenticator app. N
by landemva 4y ago
USA banks seem to have found the 2fa powerpoint presentation and are forcing accounts to use SMS 2fa, with no ability to use something like authenticator app. Nothing about SMS is secure, so their IT is taking a step backward.
- andix 4y agoSMS is still better than no 2FA, but yes, it’s not secure at all. What really bugs me, that some systems rely only on the 2nd factor, which replaces the password completely. Some even did that with SMS. So you put in you user name and then the SMS code. That’s really bad. Also a lot of Services disguise this method in the „I forgot my password“ function, where you can reset the password just with a sms code.
- account42 4y ago> SMS is still better than no 2FA Not if it can be social engineered into a 1FA password reset. Better not to give companies your phone number at all.
- andix 4y agoYes, that’s true. It should really only be used as second factor and not as a single factor for password resets. I’ve seen this too, and it’s awful. If sms is used for password resets, there should be at least an email notification and a waiting period of a few days.