Yeah, that basically destroys his argument. If I use the same password for a random internet forum with no 2FA and my bank account with SMS 2FA, then a person, who breaks into the forum DB still can not access my money.
Problem is that attackers can take advantage of that random internet forum to take over your bank account. Plant something that you would click because it is on your account and it downloads some malware. Could come up with more scenarios probably like they could target someone else from your account and use trust you have on that forum.
But it is of course question if you are worth their time.
What you said has nothing to do with SMS 2FA, and has everything to do with user/their friends' gullibility, which still must be pretty high to click something on the forum and then also launch it.
It also is totally unrelated to credential stuffing.
We are not looking for a panacea there. If you're that gullible and your forum account is pwned, no security measures will prevent you from giving up bank details.
Comments
Yeah, that basically destroys his argument. If I use the same password for a random internet forum with no 2FA and my bank account with SMS 2FA, then a person, who breaks into the forum DB still can not access my money.
Problem is that attackers can take advantage of that random internet forum to take over your bank account. Plant something that you would click because it is on your account and it downloads some malware. Could come up with more scenarios probably like they could target someone else from your account and use trust you have on that forum.
But it is of course question if you are worth their time.
What you said has nothing to do with SMS 2FA, and has everything to do with user/their friends' gullibility, which still must be pretty high to click something on the forum and then also launch it.
It also is totally unrelated to credential stuffing.
We are not looking for a panacea there. If you're that gullible and your forum account is pwned, no security measures will prevent you from giving up bank details.