5 ms·

My Hearthstone account has better security than my Paypal account. Here are some fun websites that do not support decent TOTP 2FA or U2F: - Ebay - Pay

My Hearthstone account has better security than my Paypal account. Here are some fun websites that do not support decent TOTP 2FA or U2F: - Ebay - Paypal - Most banking websites apparently because regulations *shrugs* - Twitter. The thing the POTUS uses to communicate. And here is just some utter nonsense: - Facebook supports TOTP 2fa... but you need a phone number linked to the account - Wikipedia has TOTP 2fa... but only for sysadmins - Steam is one of the rare oddballs in the gaming space, with an idiotic email-based 2fa system, which by the way constantly gets hit by massive delays.

tonyztan 9y ago
For Wikipedia, you can currently get 2FA by requesting to be added to the oauth-testing group. But yeah, it should really be enabled for everyone. https://en.wikipedia.org/wiki/Wikipedia_talk:Simple_2FA#Why_is_2FA_limited_to_Bureaucrats.2C_Admins.2C_etc.3F https://en.wikipedia.org/wiki/Wikipedia_talk:Simple_2FA#Why_...
kroltan 9y ago
Steam also has software tokens if you use the Steam mobile app. Blizzard also supports 2FA, but other than those, most gaming services don't support it indeed.
- scrollaway 9y ago
  Blizzard's 2FA is TOTP 8-digits! Here's a library/cli tool that can create tokens: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna You can use it to export the seed or a QR of it, if you want to stuff your Blizzard TOTP into andOTP or something.
ianburrell 9y ago
Steam now has Steam Guard Mobile Authenticator which does 2FA codes on the Steam mobile app. It looks like it uses TOTP but with different encoding and no way to use other app. It is now required for trades and market sales, and they need to be confirmed in mobile app.
evgen 9y ago
You only need a phone number linked to the FB account during setup. Once 2fa is turned on you can unlink the phone number.
- jlgaddis 9y ago
  A lot of sites are like this but they miss the point... which is that I don't want to give them my mobile phone number in the first place. I might, if I could reasonably trust that they really do delete it, but I think experience shows that we can't completely trust most companies nowadays.
  - technofiend 9y ago
    Sign up with any voip provider and get an SMS-capable number for one month. That's what I did for gandi.net.
- jazoom 9y ago
  Even though I've set up 2FA with Facebook, every time they ask for it they also send me the code in an SMS.
jlgaddis 9y ago
PayPal does support (at least some) 2FA methods as my first YubiKey (~6 years ago?) was a "YubiKey VIP" that worked with PayPal (6-digit codes). There was also a "Symantec VIP" mobile app that you could use (very similar to Google Authenticator) instead. PayPal also had their own security device you could get. I think it cost $5. Not sure if it's still available.
exabrial 9y ago
Fb you can have u2f and totp and disable the silly "2 factors sms" thing.

tonyztan 9y ago

For Wikipedia, you can currently get 2FA by requesting to be added to the oauth-testing group. But yeah, it should really be enabled for everyone. https://en.wikipedia.org/wiki/Wikipedia_talk:Simple_2FA#Why_is_2FA_limited_to_Bureaucrats.2C_Admins.2C_etc.3F https://en.wikipedia.org/wiki/Wikipedia_talk:Simple_2FA#Why_...

kroltan 9y ago

Steam also has software tokens if you use the Steam mobile app. Blizzard also supports 2FA, but other than those, most gaming services don't support it indeed.

scrollaway 9y ago
Blizzard's 2FA is TOTP 8-digits! Here's a library/cli tool that can create tokens: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna You can use it to export the seed or a QR of it, if you want to stuff your Blizzard TOTP into andOTP or something.

ianburrell 9y ago

Steam now has Steam Guard Mobile Authenticator which does 2FA codes on the Steam mobile app. It looks like it uses TOTP but with different encoding and no way to use other app. It is now required for trades and market sales, and they need to be confirmed in mobile app.

evgen 9y ago

You only need a phone number linked to the FB account during setup. Once 2fa is turned on you can unlink the phone number.

jlgaddis 9y ago
A lot of sites are like this but they miss the point... which is that I don't want to give them my mobile phone number in the first place. I might, if I could reasonably trust that they really do delete it, but I think experience shows that we can't completely trust most companies nowadays.
- technofiend 9y ago
  Sign up with any voip provider and get an SMS-capable number for one month. That's what I did for gandi.net.
jazoom 9y ago
Even though I've set up 2FA with Facebook, every time they ask for it they also send me the code in an SMS.

jlgaddis 9y ago

PayPal does support (at least some) 2FA methods as my first YubiKey (~6 years ago?) was a "YubiKey VIP" that worked with PayPal (6-digit codes). There was also a "Symantec VIP" mobile app that you could use (very similar to Google Authenticator) instead. PayPal also had their own security device you could get. I think it cost $5. Not sure if it's still available.

exabrial 9y ago

Fb you can have u2f and totp and disable the silly "2 factors sms" thing.