News for hackers. Stuff that matters.
Re:You don’t need SMS-2FA by UncleMeat on Wednesday July 29, 2020 @01:56PM (#23989658)
He is thinking of it from the user’s perspective rather than the service. If I reuse my passwords I still get owned even if some of my services use 2fa, because others won’t.

It’s an unusual way of thinking about it and I think the weakest part of his argument but it is interesting.

Re:You don’t need SMS-2FA by lostmsu on Wednesday July 29, 2020 @03:06PM (#23990442)
Yeah, that basically destroys his argument. If I use the same password for a random internet forum with no 2FA and my bank account with SMS 2FA, then a person, who breaks into the forum DB still can not access my money.
Re:You don’t need SMS-2FA by ozim on Thursday July 30, 2020 @03:22PM (#24001924)
Problem is that attackers can take advantage of that random internet forum to take over your bank account. Plant something that you would click because it is on your account and it downloads some malware. Could come up with more scenarios probably like they could target someone else from your account and use trust you have on that forum.

But it is of course question if you are worth their time.

Re:You don’t need SMS-2FA by lostmsu on Thursday July 30, 2020 @06:21PM (#24003484)
What you said has nothing to do with SMS 2FA, and has everything to do with user/their friends' gullibility, which still must be pretty high to click something on the forum and then also launch it.

It also is totally unrelated to credential stuffing.

We are not looking for a panacea there. If you're that gullible and your forum account is pwned, no security measures will prevent you from giving up bank details.