News for hackers. Stuff that matters.

A comment on Reddit Security Incident. Parent comment

Re:Reddit Security Incident by foepys on Wednesday August 01, 2018 @01:53PM (#17665018)
Not necessarily. Some services allow you to reset your forgotten password with a 2FA token. If your 2FA token comes by SMS, your account security relies solely on SMS. Yes, this bad practice. Yes, you should not do that. Yes, you actually only have a single factor then. But some do it that way, so don't use SMS.
[ Parent | on HN ]
Re:Reddit Security Incident by mikeash on Wednesday August 01, 2018 @02:12PM (#17665230)
That’s the whole point of my second paragraph. SMS 2FA is fine, but SMS recovery masquerading as 2FA is not.
[ Parent | on HN ]
Re:Reddit Security Incident by ReverseCold on Wednesday August 01, 2018 @03:30PM (#17666115)
> Some services allow you to reset your forgotten password with a 2FA token

Don't do this either. It makes 2FA into 1FA.

[ Parent | on HN ]