Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Two perspectives: the business and the user.

For a sophisticated user who can confidently use distinct and strong passwords for each service and protect those passwords, SMS-based 2FA offers minimal safety improvement.

For a business, they know that a significant number of their users don't do this. These users are exposed to credential stuffing attacks. SMS-based 2FA means you need to phish somebody (or otherwise obtain the code). That's an improvement for these users.

The only time where there is an active reduction in security is when SMS can be used as single factor. This is frustratingly common for password reset flows, which allows a sim-swap attack to fully compromise an account.



I feel like you have two choices for password reset flows:

1. Insecure ones

2. Ones where many users needing recovery will get locked out with no ability to recover their accounts, guaranteed




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: