News for hackers. Stuff that matters.

A comment on Tell HN: SMS-based two-factor authentication is not secure. Parent comment

Re:Tell HN: SMS-based two-factor authentication is not secure by jsnell on Wednesday June 09, 2021 @03:26PM (#27452021)
Here's the same story without 2FA:

"You get an urgent message from your bank about an unexpected $500 transaction, you follow the link & you need to enter your password as usual of course. It was a phishing website. Your bank account will be emptied."

It did not reduce security.

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by tialaramex on Wednesday June 09, 2021 @03:48PM (#27452258)
But in your revised story I don't receive reassurance that everything is going as planned. That's what I'm getting at, the SMS step is reassuring even though it actually shouldn't be.
[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by jsnell on Wednesday June 09, 2021 @05:47PM (#27453683)
If there is no 2FA, not being asked for a confirmation code is things going as normal. Also, it's totally irrelevant whether the user gets cold feet since in the password-only world they've just handed away the keys to the kingdom.
[ Parent | on HN ]