Hacker News Reader

I compromise your SMS. I initiate password recovery, and tell Vanguard "I forgot my password -- but look! It's still me! I can receive SMS challenges!"

View on HN

That's a SMS password reset mechanism, e.g. one-factor authentication, not two-factor authentication.

That's my point. Adding an SMS number to your account reduces the security of your account to one-factor SMS authentication.

The point here is that if you cannot remove the much lower sms sec then it's no more secure than sms only

Reply on news.ycombinator.com