4 ms·
... Just as we should no longer trust SMS for two-factor authentication, we shouldn’t trust it for account recovery. Disable this anywhere you can. This is int
by 127001brewer 10y ago
... Just as we should no longer trust SMS for two-factor authentication, we shouldn’t trust it for account recovery. Disable this anywhere you can.
This is interesting, but, instead of SMS, what should be used for 2FA?
- gruez 10y agoTOTP tokens?
- meepmorp 10y agoPresumably, TOTP tokens not delivered via SMS
- nileshtrivedi 10y agoDigitalOcean does this, but then they fall back on SMS in case you uninstall the TOTP app.
- bckygldstn 10y agoThis is unfortunately quite common. Facebook won't even let you use TOTP unless you have a validated phone number to use as a fallback.
- Declanomous 10y agoFurthermore, you have to install their entire app to use TOTP. Their app includes everything but the kitchen sink, and murders phone batteries even when in the background. On top of this, I don't see a point in installing apps if the functionality is also provided by their website. If I'm using my phone for 2FA, I'd like my phone to be secure, and I trust the security of my phone with just Chrome on it more than I trust my phone with Chrome and a million other apps.
- avh02 10y agothis is the comment I was looking for. not only do they do this (which is not a good excuse), they also BEG you to put in your phone number every other day. I've seen websites (I believe it was netflix) which ask for your phone number in order to provide you a way to reset your password... what happened to good old email resets?
- makomk 10y agoWhich they pretty much have to - what happens if you drop your phone and break it?
- wmf 10y agoFrom the article: personally, I recommend (in order) U2F, Push-based and TOTP/token-based