Hacker News Reader

I don’t know. It is maybe not as secure as possible but it is certainly more secure than a password.

I think it’s a baby step. I see other threads under the parent comment recommend banning SMS 2FA altogether. Surely this would be a step back. I suspect most people and companies would think, “well, I guess we won’t do 2FA anymore” rather than, “I guess we will use a proper Authenticator instead”.

View on HN

> it is certainly more secure than a password.

I disagree. I can safely store a long, complex, and unique password. I cannot prevent anyone from social engineering my cell phone service provider and doing a SIM swap.

2FA is a layer of security on top of your password. Nothing stops you from using a strong password stored in an encrypted place.

In all the cases I've seen, the password can be bypassed with a password reset using SMS, thus SMS becomes 1FA.

What if someone stole my phone and I'm unable to instantly get a replacement? I don't want to be locked out of my account either.

You're just thinking of security -- and there are many valid concerns around using SMS-based cleartext messages as a 2nd factor.

But additionally, a big issue is reliability of the 2FA mechanism. Especially when your service provider is overseas, or you're roaming, the SMSes may simply not arrive in time.

Reply on news.ycombinator.com