3 ms·
The problem isn't "2fa": the problem is services that just use it as your identity. You'll go to sign in to the account and it merely asks for your phone number
by saurik 3y ago
The problem isn't "2fa": the problem is services that just use it as your identity. You'll go to sign in to the account and it merely asks for your phone number, to which it sends a login link. Or--even more unacceptable as it makes you THINK the password matters--you'll say you "forgot your password" and it sends a code to your phone number and that code is all that was required to get back into the account. This isn't a second factor: this is replacing your first factor (your password); maybe you could call it an "alternative factor"?
- shortcake27 3y agoIt’s impressive how some of the most successful tech companies in the world get this wrong. If you give your phone number to Google, they will pressure you to enable SMS MFA and SMS account recovery. So your phone number becomes the weakest link into your account, which is pretty bad considering the state of sim swapping. Google and other companies should make this clear to users. You should never have both SMS MFA and SMS account recovery enabled. If you must, only ever enable one. Ideally, neither.
- numpad0 3y agoThey effectively outsourced IdP to telcos for free. That's the part that's wrong.