2 ms·

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the c

by nsajko 7y ago

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is probably bound by regulation or law not to force multi-factor-authentication on me. So, just say no when asked about confirming your phone number.) Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.

nine_k 7y ago
Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be). Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof. Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.
jammygit 7y ago
I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in. Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human. Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting

by nsajko 7y ago

nine_k 7y ago

Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be). Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof. Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.

jammygit 7y ago

I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in. Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human. Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting