I don't get it. Why would somebody use SMS instead of something like email to two step authenticate their login?
Who pays for the text message?
What if the SMS server is down? - Can I still login?
What does the plugin author do with my mobile number?
There are other ways to get hijacked other than simple username/password breaches. Just use SSL on your login page if you are concerned about u/p sniffing. |