4 ms·
Ask any security professional their thoughts are on SMS 2FA. It was not only unsafe, but also led to PII leaks and anon account unmasking. Good riddance.
by ed25519FUUU 4y ago
Ask any security professional their thoughts are on SMS 2FA. It was not only unsafe, but also led to PII leaks and anon account unmasking.
Good riddance.
- ceejayoz 4y agoThen ask them if it's better than nothing, especially for casual users. A lot of the folks using SMS-based 2FA will just turn it off.
- NovemberWhiskey 4y agoIt depends on your threat model. If you're an average Twitter user whose worst threat is a password spraying attack then sure, it's better than nothing. If you're someone who is likely to be targeted specifically (you're a known crypto 'investor', you're a celebrity of some kind or another) then it's a disaster. You're much better off just having a high-quality, unique password than you are with a high-quality, unique password on a site that with a password reset flow via SMS 2FA.