4 ms·
That looks like a requirement, not a choice. So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this
by mtgx 10y ago
That looks like a requirement, not a choice.
So as usual, the U2F standard being adopted by companies these days is only as strong as SMS 2FA, because of this requirement.
Can someone tell me what's the point then? Is it that they hope that in the end U2F will get popular enough that they'll remove that requirement? I would hope that's it. Otherwise, I don't see the point.
I wish they at least allowed you to opt-out of the SMS back-up before you even had to give them your number. Of course, we're talking about Facebook here, so they won't waste any opportunity to make it seem like you have no choice but to give them your phone number.
- evgen 10y agoYou can use a TOTP code generator (e.g. Authy) as your backup. No need to rely upon SMS.
- tptacek 10y agoYou can, but is there a way to do it such that Facebook won't under any circumstances send an SMS message?
- evgen 10y agoGood question. I am not sSure you can do it without using SMS to bootstrap the process, but if you have TOTP set up and then turn on U2F (with TOTP as the backup) then I think you can disable SMS messages.
- tptacek 10y agoEither I'm dumb, or if that's true it's only true since they added U2F today. (It's very possible that I'm dumb!)
- evgen 10y agoSo digging around a bit on the page the 'Learn More' in the login approvals (https://www.facebook.com/help/148233965247823 https://www.facebook.com/help/148233965247823) claims that you can turn off SMS codes, but I no longer have the advantage of being able to walk over a few desks to get a real verification :) I may try to set up U2F later today and see if this actually works... You would also need to turn off login notifications (section just above login approvals in the security settings page.)
- tyingq 10y ago>That looks like a requirement, not a choice. A requirement to have one backup, which doesn't have to be SMS. It appears to allow a manually pregenerated list of codes, for example. See the ui: https://scontent-dft4-1.xx.fbcdn.net/v/t31.0-8/p720x720/16179456_10154613701556886_7772635162244498937_o.png?oh=df2090f0bfb8c6d8e271cf6dd626a5d2&oe=590F103D https://scontent-dft4-1.xx.fbcdn.net/v/t31.0-8/p720x720/1617...
- ec109685 10y agoHaving something like yubikey is better than just SMS given the phishing attack scenario will have to convince you to type in the SMS code, which should set off alarm bells if you have a functioning yubikey installed on the device you are logging in from.
- tptacek 10y agoNo, that's not the problem with SMS. The problem with SMS is that SMS is itself insecure; in fact, there are large parts of the world where it's overtly and directly state-controlled. You won't have to enter your SMS code; the attacker will do it for you.
- secalex 10y agoYou can configure U2F+Code Generator+Backup Codes and end up with no reliance on the security of SMS for either authentication or account recovery.