It's really unclear to me why you think that email would be involved in any othe... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

rkeene2 on Aug 12, 2023 | parent | context | favorite | on: SMS traffic pumping fraud

It's really unclear to me why you think that email would be involved in any other capacity than 2FA in this scenario.

Are you imagining that email is used in some other additional way in the authentication process, such as account recovery ?

weird-eye-issue on Aug 14, 2023 [–]

You've never done a password reset? That goes to your email. If your 2FA is over email too then that isn't 2FA. Because you only need the email to take over an entire account

rkeene2 on Aug 23, 2023 | [–]

So I see the problem now, your model includes a hidden assumption that password resets go to email -- this is not always the case.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact