Re:It’s time to ditch SMS-based 2 Factor Auth
by osteele on Monday March 05, 2018 @11:27AM
(#16522112)
What you say is true of actual 2FA, which only adds security. (Unless, maybe, you take into account risk compensation[1], which is probably magnified when SMS 2FA is less secure than users think.)
However, SMS “2FA” is often used to mean SMS-based password reset, where SMS can be used instead of the password. With SMS-based password reset, SMS subtracts a factor (EDIT: or divides by two[2]?), instead of adding a factor as in 2FA.
This is the case with the OP article. The text of the article is unclear about whether it means 2FA or password reset, and the title does include the term “SMS-based 2 Factor Auth”. However, the example issues that the article links to are all cases of password reset, not 2FA.
Re:It’s time to ditch SMS-based 2 Factor Auth
by dend on Monday March 05, 2018 @11:48AM
(#16522316)
You are right, it's mostly password reset 2FA (often times it ties into auth SMS 2FA, so not necessarily mutually exclusive) - I will update the article and clarify that.
However, SMS “2FA” is often used to mean SMS-based password reset, where SMS can be used instead of the password. With SMS-based password reset, SMS subtracts a factor (EDIT: or divides by two[2]?), instead of adding a factor as in 2FA.
This is the case with the OP article. The text of the article is unclear about whether it means 2FA or password reset, and the title does include the term “SMS-based 2 Factor Auth”. However, the example issues that the article links to are all cases of password reset, not 2FA.
[1] https://en.wikipedia.org/wiki/Risk_compensation
[2] I propose that SMS-based password reset be called “Half-Factor Auth” (HFA or ½FA), to distinguish it from 2FA.