4 ms·
> I don't like 2FA either That seems to be a rather dangerous position to hold these days. I personally dislike that googles 2FA is SMS based (unless there's a
by eric_h 10y ago
> I don't like 2FA either
That seems to be a rather dangerous position to hold these days. I personally dislike that googles 2FA is SMS based (unless there's a way to use e.g. Authy with it that I'm unaware of), but still seems that the only way to be reasonably safe is a strong password and 2FA.
I'll add that The authy app on the Apple Watch has made 2FA for services that support it rather painless.
- zardeh 10y agoGoogle also allows you to use google authenticator, but I don't believe they allow third party services.
- jsudhams 10y agoGoogle does allow other apps (I think it is still same as GAuth) SASS pass and other authenticators with good. But yes they don't allow other token provides like Yubikey or RSA fobs
- brennen 10y ago> But yes they don't allow other token provides like Yubikey or RSA fobs I think this is incorrect, at least provided you're using Chrome. The implementation was buggy somewhere in the chain the last time I tried it, but it's there.
- lorenzhs 10y agoGoogle is one of the major proponents of U2F, which is based on hardware tokens. Yubikeys support it, either the cheap U2F-only one or a Neo / 4. I use it and it works flawlessly. At the moment, only Chrome implements the required APIs as far as I know, but Mozilla is working on adding it to Firefox.
- lorenzhs 10y agoYou can use any TOTP app you like, they all use the same QR code format. You can even build your own, it's all well documented.
- pugz 10y agoI use 1Password as my 2FA app for Google services. I only set it up relatively recently so maybe support for non-SMS is new. Or region-based?
- lorenzhs 10y agoIt's been there for years. Since ~1yr ago they also support U2F (hardware token based, un-phishable)