3 ms·

The two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place.

The two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place. Maybe their real intent was to collect people's phone numbers instead of protecting their accounts.

switch007 3y ago
Wasn’t it heavily pushed by tech giants for data harvesting purposes, then cargo cult copied by everyone else?
- mr_mitm 3y ago
  If that is so, the same tech giants are now pushing for passkeys, which is actually close to the ideal solution.
kevincox 3y ago
Many people reuse passwords. Forcing SMS 2FA is something that they can feasibly do, because almost everyone can receive SMS and greatly raises the difficulty of credential stuffing (from just stuffing to needing to do a SIM swap). This solves a lot of problems for service providers. Another benefit is that they can block duplicate accounts with the same phone number, this effectively adds a cost to account creation which can help to reduce spam. And yes, some will then use it to spam or sell. I don't think anyone ever thought that SMS 2FA was strong protection. It mostly benefits the service operators by reducing spam and stolen accounts.
emgeee 3y ago
It was a useful tool to better verify identity vs relying solely on email addresses, which were substantially easier to create at the time. Kinda like SSNs though, I think it's way past the point when a better designed system should have been developed. Sadly, that costs a lot of money.
chankstein38 3y ago
Right? And now my message history is the occasional conversation littered with hundreds of "Your six digit code is _____"
mr_mitm 3y ago
Still better than no second factor
MyFedora 3y ago
Never has been.
cqqxo4zV46cp 3y ago
Because SMS MFA is orders of magnitude more secure than no MFA, and there are barriers to entry for TOTP that there simply aren’t for SMS. This is an unsubstantiated conspiracy theory.

switch007 3y ago

Wasn’t it heavily pushed by tech giants for data harvesting purposes, then cargo cult copied by everyone else?

mr_mitm 3y ago
If that is so, the same tech giants are now pushing for passkeys, which is actually close to the ideal solution.

kevincox 3y ago

Many people reuse passwords. Forcing SMS 2FA is something that they can feasibly do, because almost everyone can receive SMS and greatly raises the difficulty of credential stuffing (from just stuffing to needing to do a SIM swap). This solves a lot of problems for service providers. Another benefit is that they can block duplicate accounts with the same phone number, this effectively adds a cost to account creation which can help to reduce spam. And yes, some will then use it to spam or sell. I don't think anyone ever thought that SMS 2FA was strong protection. It mostly benefits the service operators by reducing spam and stolen accounts.

emgeee 3y ago

It was a useful tool to better verify identity vs relying solely on email addresses, which were substantially easier to create at the time. Kinda like SSNs though, I think it's way past the point when a better designed system should have been developed. Sadly, that costs a lot of money.

chankstein38 3y ago

Right? And now my message history is the occasional conversation littered with hundreds of "Your six digit code is _____"

mr_mitm 3y ago

Still better than no second factor

MyFedora 3y ago

Never has been.

cqqxo4zV46cp 3y ago

Because SMS MFA is orders of magnitude more secure than no MFA, and there are barriers to entry for TOTP that there simply aren’t for SMS. This is an unsubstantiated conspiracy theory.