9 ms·
If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.
by YZF 10y ago
If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.
- 3pt14159 10y agoBut what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem. People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy. [1] Fraudsters are able to convince phone employees that they forgot their phone number and left their phone at home.
- sytse 10y agoWith Google Authenticator you would have to use your one-time codes to reset it if your phone is lost. With 1password the 2FA is no longer linked to the phone, this way you don't have to reset.
- ribosometronome 10y agoGoogle will also let you move your Authenticator to a new device with access to the account from another trusted device without needing to 2FA. So, for example, I can temporarily move Authenticator to an tablet if my phone is lost/stolen using my laptop, which is already trusted. There are some potential security drawbacks to this but access to a trusted device seems a reasonable compromise between security and convenience.
- sebcat 10y agoAlso worth noting: Google Authenticator is just TOTP[1] (X=30, Digit=6, HMAC-SHA-1 IIRC). You can just copy the URL from the QR code and use it from whatever you like, as long as your clock is somewhat synced. [1] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
- tqkxzugoaupvwqr 10y agoTypically, you are asked to print out backup codes when you enable 2FA. In addition, you could copy these backups codes into your password manager and sync your password file with multiple devices, so whenever one device is gone you can access all your passwords, including 2FA backup codes from other devices.
- stouset 10y agoIf these backup codes are in your password manager, you're effectively* back to 1FA. Same with putting the TOTP seed into it. * Yes, technically you need the 1Password file as well. But someone who compromises your machine will get access to both. Or if you have it synced to your phone and both are unlocked with a fingerprint, all someone needs is your device and a little effort to fool the fingerprint sensor.
- deleted 10y ago[deleted]
- biafra 10y agoThis doesn't help if the bank shows your linked phone number when logged in. You could also buy a dual SIM phone and buy a throwaway sim card with a phone number you do not share.
- criddell 10y agoTake government issued ID into the bank. They can reset everything for you.
- barking 10y agowrite down the secret from when you set up 2FA and store wherever you keep your valuables. Get a new phone and re-use the same secret.
- derefr 10y agoEasier: register with an SMS-enabled VoIP provider, like Twilio or voip.ms, and use said virtual SMS number as your 2FA. Rather hard to steal. You can then set the service up to forward received SMS messages to your regular SMS number—but, if your phone is compromised/stolen, you can go back to the account and immediately turn off this forwarding. --- Sadly, this approach reduces the security back to single-factor, since you get into the SMS account with something you know, rather than something you have. You can at least treat the VoIP account like a password-manager: give it a long, unforgiving "master password." (Or a random password that's stored in a password-manager, if you use one.)
- voltagex_ 10y agoA lot of providers will block VoIP and SMS gateways being used as verification (see PayPal for an example).
- derefr 10y agoAFAIK you can get a number from a different carrier and then transfer it to the VoIP carrier. When queried, it will still show up as "owned" by the original carrier.
- toast0 10y agoIt depends on how they classify; numbers are issued in blocks of 1000, and the allocations are public knowledge, but you can also do a real time carrier lookup, which changes after porting completes.
- Nexxxeh 10y agoThere's a guy that does an SMS to web gateway with real telephony hardware. You pay by bitcoin and its accessible over TOR. You pay, he pops in a topped up PAYG SIM. You have a real mobile telephone number. You can run your own private one at home with a Raspberry Pi/ttl serial adapter and a cheap SIM module. Or use a dongle.
- thaumasiotes 10y ago
- Glyptodon 10y agoNot that I recommend SMS, but if thieves steal my phone I turn off its Google voice connection and it stops getting text that particular phone #, which I can still get just fine in Google Voice. More to the point I do tend to feel like N-factor auth is often a sort of Matryoshka doll thing on one end or another more than anything.
- hdhzy 10y agoNote that one time codes do not protect against phishing the same way U2F does (U2F is always bound to secure origin).
- tptacek 10y agoU2F is great but everything is better than SMS.
- ams6110 10y agoExcept SMS is better than nothing, right? Yes it's flawed. But it's a harder attack than simple password auth. An attacker has to to target an individual and know their phone number, and be able to spoof their phone.
- tptacek 10y agoIt depends. SMS is better than nothing as a second factor, but SMS has a weird way of worming its way into single-factor status. I think people should avoid SMS 2FA, and should be skeptical of the security of companies that offer only SMS and neither of TOTP or U2F.
- StavrosK 10y agoThis frustrates me endlessly about Namecheap. They only allow SMS, and, for something as valuable as my domain name (figuratively the keys to my kingdom), that's unacceptable.