Hacker News new | past | comments | ask | show | jobs | submit login

One of the issues ignored here is the nature of cascading failures that happen during a breach due to password reuse. If a user is compromised through an active credential forwarding attack like the one described the user's account could be compromised on that service. Afterward, however, when the user's credentials are re-used by the attacker to access other accounts that attack is made significantly nosier and ineffective as the user would get an SMS for other services using 2FA.

TL;DR getting a text message every time someone logs in as you is going mean you're much more aware of what's happening with your accounts. Having that text message contain credentials means if it wasn't you logging in (and hence you weren't expecting an SMS) then the login fails.

EDIT: Password managers are great and I'm all for promoting them probably more than 2FA even. The difference between a password manager and 2FA is that a password manager does literally nothing given that your password is known. In that same situation 2FA still does do something and so this appears to be a false dichotomy.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: