4 ms·

Weird. My fortune 100 company doesn’t use SMS for 2FA.

• kristofferg 3y ago
  It is still very common for business clients of all sizes, in all industries (even critical infra) to request 2FA via SMS. Good for the company you work for that they dont :)
  • yosito 3y ago
    When they request it, they should receive pushback. SMS 2FA is a bad business decision with potentially severe consequences for customers.
    • cbzoiav 3y ago
      "We recommended you went for X and listed SMS security problems as the reasons - here is the email chain" You need to cover your ass, but you don't want to actively push back and risk losing the sale.
• throwaway2037 3y ago
  I assume that all of Fortune 500 (minus tech majors) use RSA hard and soft tokens. Ref: https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID
  • tinus_hn 3y ago
    Quite possibly with SMS as the fallback option in case the soft token is lost.
    • pnpnp 3y ago
      We have a human in the loop as the fallback. It’s just a different attack vector. Brute force becomes a lot harder, but social engineering becomes easier.
  • rkeene2 3y ago
    The world's largest employer (US Government) uses Smartcards (and no passwords).