3 ms·
To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.
by heartsucker 10y ago
To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.
- cdubzzz 10y agoBy that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.
- scrollaway 10y ago"Google Authenticator" style 2fa is an open spec. You can build your own authenticator to your own liking. So no, "by that logic" doesn't apply. You can choose to use something else than a phone to auth, but if it's SMS based well... I just came back from a week in France where I had zero cell connectivity. Had I been using any kind of SMS based 2fa, I would have lost access to those accounts with no forewarning.
- heartsucker 10y agoBut I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options. My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.
- cdubzzz 10y agoHow is TOTP being an open spec relevant? If $TOTP_APP does not work when you need it, it doesn't really matter. Even with a backed up secret. All I'm really saying is that limited options does not mean "broken". It just means limited options.
- heartsucker 10y agoIt's relevant because it means there are N apps out there instead of the exactly one pair of "my SIM" and "a tower my provider can use to reach my phone."