Re:Tell HN: SMS-based two-factor authentication is not secure
by UncleMeat on Wednesday June 09, 2021 @01:41PM
(#27450803)
TOTP is marginally safer than SMS.
It also comes with large downsides. Security is an economics game. Marginal improvements in security posture are not always worth the cost.
There are a bunch of people who insist that web services should drop SMS completely and demand that all users use TOTP (at least). I question the value of this change given that TOTP only protects you in comparatively rare cases.
It also comes with large downsides. Security is an economics game. Marginal improvements in security posture are not always worth the cost.
There are a bunch of people who insist that web services should drop SMS completely and demand that all users use TOTP (at least). I question the value of this change given that TOTP only protects you in comparatively rare cases.