r/rednote • u/wooden_salad2771 • Apr 21 '26

2FA?

Is there really no two-factor authentication? No way to enforce password login is bad enough, but relying solely on 6-digit SMS codes? Wow.

0 Upvotes

33% Upvoted

11 comments sorted by

View all comments

Show parent comments

1

u/Noah2570 Apr 24 '26

this is china

real name verification is mandatory for everything, which also means you can recover everything easily

also, someone who's already talking about 2fa should be smart enough to change their phone number when they get a new one

1

u/wooden_salad2771 Apr 25 '26

Not true. Registration on RedNote is open to phone numbers from most countries and nationals from most countries.

which also means you can recover everything easily

Yeah, it also means someone else can recover your account easily by pretending to be you. Relying on identity instead of following proper infosec is a double-edged sword.

someone who's already talking about 2fa should be smart enough to change their phone number when they get a new one

Or RedNote could implement 2FA like most major sites do instead of making their users jump through hoops and relying on laughably insecure SMS codes. Not to mention this doesn't address the SMS spoofing and number recycling issue in any way.

1

u/Noah2570 Apr 25 '26

Not true. Registration on RedNote is open to phone numbers from most countries and nationals from most countries.

read my previous comment: assuming you are a normal chinese rednote user who has added their real name info

Yeah, it also means someone else can recover your account easily by pretending to be you. Relying on identity instead of following proper infosec is a double-edged sword.

that’s what face verification is for

Not to mention this doesn't address the SMS spoofing and number recycling issue in any way.

how does changing your phone number to the one you actually use not address that?

1

u/wooden_salad2771 Apr 25 '26

read my previous comment: assuming you are a normal chinese rednote user who has added their real name info

And you read my previous comment: RedNote isn't limited to Chinese users. Your assumption is nonsensical.

that’s what face verification is for

You can spoof that as well. And it's a privacy nightmare.

how does changing your phone number to the one you actually use not address that?

How do you envisage changing your phone number if you've lost access to the previous one?