News for hackers. Stuff that matters.
Re:Google is going to turn on 2FA by default by JimDabell on Saturday May 08, 2021 @12:40PM (#27088671)
Enabling SMS 2FA doesn't make your account less secure. At worst, if somebody targets you with SIMjacking, it simply doesn't make you more secure.

If you don’t have 2FA enabled for your account, you are in the least secure position compared with enabling any 2FA method.

Either way, there’s no need to use SMS for 2FA with Google, they support many other forms of 2FA.

Re:Google is going to turn on 2FA by default by PeterisP on Saturday May 08, 2021 @01:02PM (#27088879)
Often enabling SMS 2FA also enables SMS as a password reset option, which does make you less secure, since SIMjacking is easier than guessing a reasonable not-reused password.
Re:Google is going to turn on 2FA by default by fr2null on Saturday May 08, 2021 @01:27PM (#27089101)
If that is the case though, you are not really enabling SMS 2FA. It is just SMS (1F) authentication.

Real 2FA would (theoretically) never make your account less secure than 1FA, because even if the second factor has 0 security, it shouldn't decrease the security of the first factor.

However, it is true that this may not always be the case for imperfect implementations, like your example. I can aldo imagine that social engineering might have a higher succes ratio if the intruder can say "it really is me! I have the correct second factor, I just lost my first factor...".

Re:Google is going to turn on 2FA by default by CarelessExpert on Saturday May 08, 2021 @01:24PM (#27089064)
With Google you can disable SMS-based account recovery independent of your 2FA options.
Re:Google is going to turn on 2FA by default by GhostVII on Saturday May 08, 2021 @12:44PM (#27088710)
I think Google actually allowed you to just use your phone number to recover your account, so it was effective 1FA. In that case it would be less secure. They might have changed it now though.