4 ms·

I wish Google, Twitter et al would listen to this, but alas...

• neuralspark 7y ago
  Google offers 2FA using TOTP, and has for several years.
  • sneak 7y ago
    And U2F tokens, which are even better than TOTP as they are immune to phishing. TOTP codes can be and commonly are phished. U2F is the current state of the art for 2FA. App/Device-based 2fa (krypton, Google App’s “approve on other device”, authy’s “approve on other device”, keybase, et c) are second. TOTP is in a lot of ways more trouble than it is worth.
    • codedokode 7y ago
      Also physical tokens can be easier to use if the support for them is built into OS and doesn't require installing or configuring additional software.
• jdeibele 7y ago
  At least Google allows you to turn off SMS as a "2FA" source. You can set up Google Authenticator (or Authy) and a Yubikey as 2FA sources, then remove your phone number. Much to my surprise, I was able to do this with PayPal where I set up two Symantec VIP Access IDs and was able to remove the phone number. I wish I could do this with other accounts.