Re:You don’t need SMS-2FA
by UncleMeat on Wednesday July 29, 2020 @03:18PM
(#23990549)
But is that true? The hacker got the pw database somehow. So it isn’t a given that they need your sms to impersonate you, since they clearly have breached the system already.
[ Parent
| on HN ]
> So it isn’t a given that they need your sms to impersonate you,
Correct. It's possible the entire system is compromised. It's also possible the entire system is not compromised, and the data breach happened without the target institution losing control of their systems.
> since they clearly have breached the system already.
No, not necessarily. Someone could, say, export the contents of a database and put it somewhere public. A data breach is not necessarily the result of hackers getting total control of the target.