3 ms·
I don't see how email-based 2FA is more secure than SMS. With email, if an attacker gains access to my email account she can remotely de-auth my mobile device'
by njovin 3y ago
I don't see how email-based 2FA is more secure than SMS.
With email, if an attacker gains access to my email account she can remotely de-auth my mobile device's email client, reset my password for service X, and sign in to service X without my knowledge (assuming I don't notice my email client has stopped working).
With SMS, if they gain access to my email account, I at least get the notice of the attempted login via SMS and can take appropriate action.
- semiquaver 3y agoSMS is architecturally insecure. It’s been demonstrated time and time again that cellular providers cannot effectively prevent SIM-hijacking via social engineering and other means. Email isn’t perfect, but I believe that my account is much more resistant to takeover than my phone number is.