News for hackers. Stuff that matters.

A comment on Tell HN: Please Remove SMS as a 2nd Factor.

Re:Tell HN: Please Remove SMS as a 2nd Factor by HugoHobling on Thursday September 05, 2019 @05:30PM (#20890811)
I don't think it's that simple. From Google's research, SMS 2FA is highly effective against credential stuffing attacks: 100% coverage against automated bots and 96% against bulk phishing:

https://security.googleblog.com/2019/05/new-research-how-eff...

SMS 2FA can fail, spectacularly, for targeted attacks. TOTP would not solve this, only U2F/webauthn.

[ Parent | on HN ]
Re:Tell HN: Please Remove SMS as a 2nd Factor by a3n on Thursday September 05, 2019 @06:26PM (#20891205)
<tinhat>But Google wants your phone number for correlation with ... other stuff, and ... other people. So they would say it's good.</tinhat>
[ Parent | on HN ]