News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by taeric on Tuesday July 26, 2016 @08:08AM (#12164992)
I'm confused. Both of these are just "something the user knows," right? Making this explicitly not 2-factor.

Or, are we treating the ephemeral 1-time-use token as something the user has?

[ Parent | on HN ]

There are no comments on this comment yet.