News for hackers. Stuff that matters.
Re:Yubico launches its dual USB-C and Lightning two-factor s... by archi42 on Tuesday August 20, 2019 @09:54AM (#20747058)
You're right, but I dislike that route for three reasons:

1. It should just be plain unnecessary to apply such a hack.

2. There is still a single weak point for all services.

3. While this prevents against the run-of-the-mill "attacker activates another SIM card for my mobile number and steals my crypto cash from $online_wallet" coming up here every few month, a more sophisticated attacker can just route the SMS to himself via SS7 (I suppose the SIM variant is easier to pull off with less traces, and obviously requires much less technical expertise).

Re:Yubico launches its dual USB-C and Lightning two-factor s... by munchbunny on Tuesday August 20, 2019 @10:02AM (#20747133)
I agree with all of your points. Really Github should just let you remove any dependency on SMS entirely. I lucked out in that I never configured SMS as a fallback. I have backup codes printed out in a safe.