Re:It’s time to stop using SMS for security
by unscaled on Tuesday March 16, 2021 @05:19AM
(#26474542)
This is not emphasized enough. Many companies enable SMS both as a second authentication factor AND a single-factor account recovery mechanism.
As bad as passwords, savvy users can use a password manager and generate unique high-entropy passwords, but if the web site is forcing SMS on you, you lose all that security and now have to rely on vulnerable telco infra that is out of your control and was never built to facilitate authentication.
As bad as passwords, savvy users can use a password manager and generate unique high-entropy passwords, but if the web site is forcing SMS on you, you lose all that security and now have to rely on vulnerable telco infra that is out of your control and was never built to facilitate authentication.