5 ms·

While that's annoying, I wouldn't call lit broken. Most 2FA-enabled services I know want a phone number first, including Google (and from what I remember Facebo

While that's annoying, I wouldn't call lit broken. Most 2FA-enabled services I know want a phone number first, including Google (and from what I remember Facebook as well). If you're worried about your privacy, which is understandable, buy a prepaid sim card, a cheap phone and use it only for your 2FA accounts. Not sure about the US, but in my country prepaid GSM sim cards are cheap and you don't have to give away your ID to buy one (though this may change soon).

heartsucker 10y ago
To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.
- cdubzzz 10y ago
  By that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.
  - scrollaway 10y ago
    "Google Authenticator" style 2fa is an open spec. You can build your own authenticator to your own liking. So no, "by that logic" doesn't apply. You can choose to use something else than a phone to auth, but if it's SMS based well... I just came back from a week in France where I had zero cell connectivity. Had I been using any kind of SMS based 2fa, I would have lost access to those accounts with no forewarning.
  - heartsucker 10y ago
    But I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options. My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.
    - cdubzzz 10y ago
      How is TOTP being an open spec relevant? If $TOTP_APP does not work when you need it, it doesn't really matter. Even with a backed up secret. All I'm really saying is that limited options does not mean "broken". It just means limited options.
      - heartsucker 10y ago
        It's relevant because it means there are N apps out there instead of the exactly one pair of "my SIM" and "a tower my provider can use to reach my phone."
Matt3o12_ 10y ago
If you do so, please be sure to check how often you have to top up the number so it isn't "freed". The prepaid provider I used to use had me top it up every 6 months for at least 5€ ($7 at the time), to keep my number. I can't really blame them, though because they also have to pay for the numbers.
mintplant 10y ago
> I wouldn't call lit broken It's vulnerable to social engineering of your cell provider's customer support line, for one. It's happened before [1]. [1] http://gizmodo.com/how-hackers-reportedly-side-stepped-gmails-two-factor-a-1653631338 http://gizmodo.com/how-hackers-reportedly-side-stepped-gmail...

heartsucker 10y ago

To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.

cdubzzz 10y ago
By that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.
- scrollaway 10y ago
  "Google Authenticator" style 2fa is an open spec. You can build your own authenticator to your own liking. So no, "by that logic" doesn't apply. You can choose to use something else than a phone to auth, but if it's SMS based well... I just came back from a week in France where I had zero cell connectivity. Had I been using any kind of SMS based 2fa, I would have lost access to those accounts with no forewarning.
- heartsucker 10y ago
  But I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options. My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.
  - cdubzzz 10y ago
    How is TOTP being an open spec relevant? If $TOTP_APP does not work when you need it, it doesn't really matter. Even with a backed up secret. All I'm really saying is that limited options does not mean "broken". It just means limited options.
    - heartsucker 10y ago
      It's relevant because it means there are N apps out there instead of the exactly one pair of "my SIM" and "a tower my provider can use to reach my phone."

Matt3o12_ 10y ago

If you do so, please be sure to check how often you have to top up the number so it isn't "freed". The prepaid provider I used to use had me top it up every 6 months for at least 5€ ($7 at the time), to keep my number. I can't really blame them, though because they also have to pay for the numbers.

mintplant 10y ago

> I wouldn't call lit broken It's vulnerable to social engineering of your cell provider's customer support line, for one. It's happened before [1]. [1] http://gizmodo.com/how-hackers-reportedly-side-stepped-gmails-two-factor-a-1653631338 http://gizmodo.com/how-hackers-reportedly-side-stepped-gmail...