Re:NIST declares the age of SMS-based 2-factor authenticatio...
by lloeki on Tuesday July 26, 2016 @02:07AM
(#12163646)
> maybe an old pet name with an exclamation point on the end for extra security
Nope, this is the answer to the recovery question ;-) which amounts to a password anyway. I wish recovery questions would just die finally.
A pattern I've seen often is people not remembering their password and just resetting it via SMS each time, making SMS 1FA. Although very real, taking the real-world risk of SIM cloning is pragmatically still better than reused, ridiculous passwords and/or ones that end up in leaked lists which amount to no auth.
Nope, this is the answer to the recovery question ;-) which amounts to a password anyway. I wish recovery questions would just die finally.
A pattern I've seen often is people not remembering their password and just resetting it via SMS each time, making SMS 1FA. Although very real, taking the real-world risk of SIM cloning is pragmatically still better than reused, ridiculous passwords and/or ones that end up in leaked lists which amount to no auth.