|
In response to
"Just seems like overkill. If someone has my phone and uses my face to access the account, the code also goes to the phone that they are holding. -- nm"
by
Volnelk
|
The weakness is that phone numbers can be cloned and text messages are sent to not your phone. The text system was never designed to be secure
Posted by
JD (aka Jason Dean)
Dec 4 '24, 08:06
|
So that's the vector that attackers use.
They clone a number. They have your login but not password for a site so they use the reset password function and the confirming code goes to the number on the account but the attackers receive the code as they're the ones receiving the texts.
They use the code, reset the password and then have access to the account
|