Re:Google is going to turn on 2FA by default
by PeterisP on Saturday May 08, 2021 @01:02PM
(#27088879)
Often enabling SMS 2FA also enables SMS as a password reset option, which does make you less secure, since SIMjacking is easier than guessing a reasonable not-reused password.
[ Parent
| on HN ]
Re:Google is going to turn on 2FA by default
by fr2null on Saturday May 08, 2021 @01:27PM
(#27089101)
If that is the case though, you are not really enabling SMS 2FA. It is just SMS (1F) authentication.
Real 2FA would (theoretically) never make your account less secure than 1FA, because even if the second factor has 0 security, it shouldn't decrease the security of the first factor.
However, it is true that this may not always be the case for imperfect implementations, like your example. I can aldo imagine that social engineering might have a higher succes ratio if the intruder can say "it really is me! I have the correct second factor, I just lost my first factor...".
Re:Google is going to turn on 2FA by default
by CarelessExpert on Saturday May 08, 2021 @01:24PM
(#27089064)
With Google you can disable SMS-based account recovery independent of your 2FA options.