3 ms·
SMS is still better than no 2FA, but yes, it’s not secure at all. What really bugs me, that some systems rely only on the 2nd factor, which replaces the passwo
by andix 4y ago
SMS is still better than no 2FA, but yes, it’s not secure at all.
What really bugs me, that some systems rely only on the 2nd factor, which replaces the password completely. Some even did that with SMS. So you put in you user name and then the SMS code. That’s really bad. Also a lot of Services disguise this method in the „I forgot my password“ function, where you can reset the password just with a sms code.
- account42 4y ago> SMS is still better than no 2FA Not if it can be social engineered into a 1FA password reset. Better not to give companies your phone number at all.
- andix 4y agoYes, that’s true. It should really only be used as second factor and not as a single factor for password resets. I’ve seen this too, and it’s awful. If sms is used for password resets, there should be at least an email notification and a waiting period of a few days.