It’s time to stop using SMS for security

Re:It’s time to stop using SMS for security by mysterydip on Tuesday March 16, 2021 @06:45AM (#26475066)

Even easier are the sites that do this: "Please enter the phone number where we should send your one-time 2FA code: [_______]"

I've had that happen on more than one site. Surely anyone who stole my password would just put in their own number?

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by elcomet on Tuesday March 16, 2021 @07:32AM (#26475372)

They would surely compare the number to the one they have registered, right ?

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by whatastory on Tuesday March 16, 2021 @08:28AM (#26475801)

Google oftentimes doesn't.

One of my accounts requires a phone number to verify every single time I login. I have no clue why, and it accepts absolutely any phone number.

I have no clue what the purpose is aside from forcing me to give sensitive information to other people when my phone isn't available or I'm traveling (which I've been forced to do already).

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by alanfranz on Tuesday March 16, 2021 @10:34AM (#26477202)

You didn’t set a 2fa in that account. So they ask for a phone number to correlate the login.

[ Parent | on HN ]

Re:It’s time to stop using SMS for security by sodality2 on Tuesday March 16, 2021 @08:09AM (#26475631)

You'd think they would make it more clear ("verify your 2fa number"). Maybe they want to bait criminals into entering their own or something.

[ Parent | on HN ]