3 ms·

Those are good points but I'm not a fan of two factor SMS. It made sense in the day where a cellphone could make calls and do texting and nothing more, but smar

by mzs 11y ago

Those are good points but I'm not a fan of two factor SMS. It made sense in the day where a cellphone could make calls and do texting and nothing more, but smartphones are used like computers now. Say you have the typical situation with no pin on the phone and password auto-filled by the mobile browser for the site. Now if someone loses that phone, another person can login, looking at history or auto-fill settings for clues. Alternatively, if there is a password for the site, it's either really simple or the password reset request will come in to the mail client on the phone. Since phones are way more than they used to be, for two factor these days it should be a separate dongle that only does the one factor and it is forced to have a pin by the vendor before it can be used. So SMS two-factor is not really all that much better security-wise and it makes it more inconvenient, doubly so for those like me that don't even have a cellphone.

IceSt0rm 11y ago
If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed. People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator). In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).
- runamok 11y ago
  In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.

by mzs 11y ago

IceSt0rm 11y ago

If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed. People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator). In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).

runamok 11y ago
In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.