3 ms·
The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did
by RcouF1uZ4gsC 7y ago
The big benefit of SMS for the website is that it outsources the problem of lost 2FA tokens. What happens if the user loses a yubikey. Or changes phones and did not back up their TOTP. With SMS authentication, even if the user loses a phone, they can go down to the local cell phone store and get a new phone on their number and be back in business without the website having to get involved.
- thephyber 7y agoDouble-edged sword. Your website is outsourcing security to any company which can service a cell phone account, which may be better than your website security or worse.
- 0xff00ffee 7y ago> What happens if the user loses a yubikey. Always buy two. ;-) Joking aside, I've moved almost every 2FA to hard token, soft-token, or google voice. But the root of trust is still LastPass & Google. I don't see an easy way out of dependency other than power of attorney. Even worse: I worry what happens to my protected assets as I age and possibly face memory loss.
- dmoy 7y agoBackup access in a bank safety deposit box is what I do.
- Nextgrid 7y agoI read an article here some time ago that banks take no responsibility if they lose/destroy the contents of their boxes as someone learnt the hard way with precious family possessions.
- dmoy 7y agoRight that's why you should verify your backups every year. No place you store your backup can guarantee it won't be lost or destroyed.
- 1996 7y agoBad idea: google will disable your google voice after some time of not logging in. I got bitten in a bad way! Hopefully twilio will start creating "recognized" numbers someday, as my twilio number is unusable for TOTP. There seems to be a blacklist of all twilio voip numbers.
- 0xff00ffee 7y agoInteresting! I generally check it once a week. Any idea what their timeout is?
- compuguy 7y agoHaving either a second yubikey or a totp app as a back up is a wise thing to have. Seriously.
- awinter-py 7y agogithub & gitlab require you to register a TOTP authenticator app before you can enable U2F (presumably to avoid manual resets, although they don't say) google's enhanced protection requires you to have 2 distinct yubikeys to sign up
- willvarfar 7y agoI know that google branded “titan” yubikeys come in pairs. One is for keeping in a safe place for recovery.