3 ms·
"No 2FA. If the only option available is SMS or call-based authentication, do not use 2FA." I see no problem with password + SMS or password + phone. The big p
by benmanns 13y ago
"No 2FA. If the only option available is SMS or call-based authentication, do not use 2FA."
I see no problem with password + SMS or password + phone. The big problem is that some companies think that their second factor overrides the first factor, and choose a weak second factor. 2FA must be an && operation, not an || operation, for all modes of authentication. Otherwise, you are exactly right, and attackers will compromise the weakest link in the chain.
- michaelmior 13y agoAgreed. If BOTH are required than even if the second factor is relatively weak, it's still better than password-only.
- deleted 13y ago[deleted]
- poutine 13y agoIf both are not required it's not a second factor. Two factor is something you know (password) plus something you have (a phone number).