4 ms·
If you can't use your phone number for password recovery or SMS to your phone number as the 2FA, what do you use instead?
by scholia 10y ago
If you can't use your phone number for password recovery or SMS to your phone number as the 2FA, what do you use instead?
- jfoutz 10y agoPresumably a security key. A Yubikey or something like it.
- deleted 10y ago[deleted]
- tptacek 10y agoThe best-practices 2FA stack is: * U2F token (primary method) * TOTP via phone app (backup) * Backup keys printed or on encrypted USB, in a safe. * SMS disabled explicitly. TOTP fallback doesn't reduce security meaningfully, because U2F principally protects against phishing. But SMS fallback is devastating to security.
- scholia 10y agoThanks!
- zobzu 10y agoyou don't lose your 2fa. thats it. all other options are unsafe