4 ms·
We need another repo for stupid 2FA rules. Looking at you United Airlines.
by jonahhorowitz 7y ago
We need another repo for stupid 2FA rules. Looking at you United Airlines.
- skunkworker 7y agoAdd Chase to that list. They don’t offer TOTP and are vulnerable to cellular account takeover attacks.
- yellowapple 7y agoMy credit union has the same issue (no TOTP, only options for second-factor are email and phone call, with no way to disallow one or the other).
- newnewpdro 7y agoI didn't even bother enabling online banking with my local bank because of this. None of the local banks have a damn clue so I just use them as if it's 1995; ATM and IRL. I only use them for cashing checks though so it's no big deal. E-Trade has a decent security story though. 2FA w/hw token, and they refund all ATM fees on the checking account so it's decent for general banking in addition to trading.
- hannasanarion 7y agoMicrosoft OWA for business. It automatically sends a 2FA message to your phone whenever a session times out, whether you asked for it or not. Because it's totally not a bad thing to train users to accept unknown 2FA requests in the middle of the night because "it's probably just my work computer refreshing itself".