4 ms·
This is why SMS- or phone-based 2FA is not a good idea. HOTP/TOTP is the right way to implement 2-factor auth. https://en.wikipedia.org/wiki/HMAC-based_One
by antsar 11y ago
This is why SMS- or phone-based 2FA is not a good idea. HOTP/TOTP is the right way to implement 2-factor auth.
https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm
https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm
- azinman2 11y agoAnd totally impractical for most people...
- ossreality 11y ago.... what? You must be massively misunderstanding if you think SMS-2FA is easier than HOTP or TOTP. Did you even ... read the links?
- antsar 11y agoGoogle Authenticator is pretty easy to use, as are the alternatives. Also really easy to provision. Not sure how SMS is more practical than an offline code generator.
- azinman2 11y agoFirst notice how "pretty easy" isn't the same as straightforward. Good luck getting my mom to figure it out. If you lose your phone, upgrade to a new one, or erase and restore it you lose all your authenticator credentials. That doesn't happen with SMS. If you're in a situation where security is paramount, then physical cards or authenticator are a better way to go. If you're 99.9% of the population, Sms is a far better solution.