Hacker News Reader

Comment by fulafel | Hacker News Reader

It's really ½FA, worse than 1FA authentication because it's sufficient to clear any 1 of the 2 factors.

I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck.

If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA

It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.

Using your logic, doesn't the ability to social engineer access to a password make passwords less than 1 FA as well?

A password is a factor of authentication, so by definition is 1FA. Any service which allows access to the account through social engineering could be labeled as having less than 1FA.

If an attacker could access your account without knowing any of your secrets, then it's really 0FA.

Suppose you mistype your password and get a page saying "wrong password, log in anyway?" You click yes and are logged in to your account. Would you consider that account to be password-protected?

To me, a second factor that can bypass the first factor is exactly the same as this situation. Being able to hack your way into an account is a different issue.

Reply on news.ycombinator.com