3 ms·
The new Twitter; where insecurity is a for-pay feature.
by NovemberWhiskey 4y ago
The new Twitter; where insecurity is a for-pay feature.
- ed25519FUUU 4y agoAsk any security professional their thoughts are on SMS 2FA. It was not only unsafe, but also led to PII leaks and anon account unmasking. Good riddance.
- ceejayoz 4y agoThen ask them if it's better than nothing, especially for casual users. A lot of the folks using SMS-based 2FA will just turn it off.
- NovemberWhiskey 4y agoIt depends on your threat model. If you're an average Twitter user whose worst threat is a password spraying attack then sure, it's better than nothing. If you're someone who is likely to be targeted specifically (you're a known crypto 'investor', you're a celebrity of some kind or another) then it's a disaster. You're much better off just having a high-quality, unique password than you are with a high-quality, unique password on a site that with a password reset flow via SMS 2FA.