4 ms·

Especially in the absence of a universally available, universally usable alternative. The user experience of TOTP authenticator apps, paper recovery codes, and

Especially in the absence of a universally available, universally usable alternative. The user experience of TOTP authenticator apps, paper recovery codes, and (so far) U2F tokens just isn't there yet, and the negative impact to individuals from being inadvetantly locked out by the loss of their second factor is massive. SMS for recovery is deeply flawed, but it's 1) better than nothing and 2) better than any current alternative for the vast majority of people.

ubercow13 7y ago
But... the experience of SMS as a second factor is also miserable. You don't have access to it when you're abroad, you can lose access to a phone number just the same as any other 2nd factor. In fact it seems more likely because there are other unrelated reasons that the phone company might take the phone number from you, in addition to the possibility of physical loss. In addition if you need to change phone numbers it is not easy to remember all the services that have that number stored as a factor to change them all.
- laughinghan 7y ago
  But you can also gain back a phone number, by bringing your new phone to the phone company's physical location and presenting ID. That's not really an option with TOTP tokens. I mostly agree with the other points (although I don't think I'm the only one with Wi-Fi calling and SMS, even abroad).
  - majewsky 7y ago
    > But you can also gain back a phone number ...at which point the attacker has already taken over all your important online accounts and changed them to a different phone number.
    - laughinghan 7y ago
      Not without your password. The comment I was replying to specifically referred to the phone number as a 2nd factor. This excludes services like Twitter where a phone number can be the sole factor used to reset your password (which is awful security, obviously). Also, you're specifically talking about SIM-jacking. The vast majority of people have upgraded phones, or broken or lost and then replaced a phone, far more times than they have been SIM-jacked. What do they do about their TOTP tokens in those scenarios?
  - ubercow13 7y ago
    That depends on the way the phone company operates surely? You can’t do it if you are abroad, or if it’s a prepay SIM and the phone company doesn’t know your identity. Some telcos will give your number to somebody else if you don’t connect with the network for too long.
    - laughinghan 7y ago
      Sure, you're totally right that in some cases, physically losing a phone also means loss of that phone number. But in 100% of cases, physically losing a phone means loss of those TOTP tokens. For the vast majority of people, that's a dealbreaker, in spite of SMS being deeply flawed, as the comment you originally replied to said.
bjornjaja 7y ago
It’s a shame people don’t know how to print out paper tokens and keep them safe.
- stan_rogers 7y ago
  To a good first approximation, nobody has a printer.
  - terragon 7y ago
    I assume everyone does have a pen. You don’t even need to write down all the provided recovery codes; just one will do.
    - bradleybuda 7y ago
      How would I, a human being with no knowledge of cryptography or application security, know that?
aledalgrande 7y ago
I think the 1Password experience for 2FA is pretty good, even on mobile. Literally just have to paste the code.
ghaff 7y ago
And, unless you're willing to say "tough noogies" if someone loses access to their token/app/codes you're back to the original problem of reliably verifying identity and ownership, especially in a virtual setting where telling someone to show up at a physical location with all their paperwork is not really viable.

ubercow13 7y ago

But... the experience of SMS as a second factor is also miserable. You don't have access to it when you're abroad, you can lose access to a phone number just the same as any other 2nd factor. In fact it seems more likely because there are other unrelated reasons that the phone company might take the phone number from you, in addition to the possibility of physical loss. In addition if you need to change phone numbers it is not easy to remember all the services that have that number stored as a factor to change them all.

laughinghan 7y ago
But you can also gain back a phone number, by bringing your new phone to the phone company's physical location and presenting ID. That's not really an option with TOTP tokens. I mostly agree with the other points (although I don't think I'm the only one with Wi-Fi calling and SMS, even abroad).
- majewsky 7y ago
  > But you can also gain back a phone number ...at which point the attacker has already taken over all your important online accounts and changed them to a different phone number.
  - laughinghan 7y ago
    Not without your password. The comment I was replying to specifically referred to the phone number as a 2nd factor. This excludes services like Twitter where a phone number can be the sole factor used to reset your password (which is awful security, obviously). Also, you're specifically talking about SIM-jacking. The vast majority of people have upgraded phones, or broken or lost and then replaced a phone, far more times than they have been SIM-jacked. What do they do about their TOTP tokens in those scenarios?
- ubercow13 7y ago
  That depends on the way the phone company operates surely? You can’t do it if you are abroad, or if it’s a prepay SIM and the phone company doesn’t know your identity. Some telcos will give your number to somebody else if you don’t connect with the network for too long.
  - laughinghan 7y ago
    Sure, you're totally right that in some cases, physically losing a phone also means loss of that phone number. But in 100% of cases, physically losing a phone means loss of those TOTP tokens. For the vast majority of people, that's a dealbreaker, in spite of SMS being deeply flawed, as the comment you originally replied to said.

bjornjaja 7y ago

It’s a shame people don’t know how to print out paper tokens and keep them safe.

stan_rogers 7y ago
To a good first approximation, nobody has a printer.
- terragon 7y ago
  I assume everyone does have a pen. You don’t even need to write down all the provided recovery codes; just one will do.
  - bradleybuda 7y ago
    How would I, a human being with no knowledge of cryptography or application security, know that?

aledalgrande 7y ago

I think the 1Password experience for 2FA is pretty good, even on mobile. Literally just have to paste the code.

ghaff 7y ago

And, unless you're willing to say "tough noogies" if someone loses access to their token/app/codes you're back to the original problem of reliably verifying identity and ownership, especially in a virtual setting where telling someone to show up at a physical location with all their paperwork is not really viable.