Hacker News Reader

Having 2fa with SMS is still better than no 2fa at all.

Sure, TOPT would be far better, but reading this article I'm more concerned with how easy it is to get access to someone's SMS/VoiceMail than anything else.

View on HN

Many service providers allow account recovery via sms, effectively making it the only factor needed. This is the big concern in my experience.

It is much worse, if attacker can use the SMS to bypass the password entirely and own the account.

Reply on news.ycombinator.com