Convincing and training old retirees to use 2FA is not something I will wish on my worst enemy.
back
1 comments
The way it's commonly implemented - through SMS - isn't secure anyway. It's relatively easy to persuade an overworked employee at the phone company to issue a new SIM card.
Having to call/visit and social engineer an employee is an order of magnitude more work than just logging in with stolen credentials, which can be entirely automated. SMS 2FA is valuable when it can prevent credential stuffing attacks. It's a vulnerability when it can be used to reset passwords and recover accounts.
I don’t think this is as true as it once was. These days this stuff is all handled by an automated system that makes you prove your identity / ownership of the number. And support staff likely aren’t given access to override this.