Re:You don’t need SMS-2FA
by scott_s on Wednesday July 29, 2020 @03:30PM
(#23990673)
> So it isn’t a given that they need your sms to impersonate you,
Correct. It's possible the entire system is compromised. It's also possible the entire system is not compromised, and the data breach happened without the target institution losing control of their systems.
> since they clearly have breached the system already.
No, not necessarily. Someone could, say, export the contents of a database and put it somewhere public. A data breach is not necessarily the result of hackers getting total control of the target.
Correct. It's possible the entire system is compromised. It's also possible the entire system is not compromised, and the data breach happened without the target institution losing control of their systems.
> since they clearly have breached the system already.
No, not necessarily. Someone could, say, export the contents of a database and put it somewhere public. A data breach is not necessarily the result of hackers getting total control of the target.