6 ms·
They (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generall
by sfifs 7y ago
They (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access.
In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets delivered.
- DaiPlusPlus 7y agoHOTP-based 2FA systems (like Google Authenticator) do not require internet connections.
- lol768 7y agoDon't most folks uses TOTP-based schemes with Google Authenticator? Unless you're using HOTP to mean HOTP and all extending schemes.
- davchana 7y agoYeah, and my local walmart has a section where there is no network coverage; I was browsing the store and wanted to check something on my bank app; it prompted me for SMS code, which I didn't receive because of no network; & I would not have received the Google prompt if I needed one for the same reason.
- wwwigham 7y agoI'm pretty sure the Microsoft authenticator has a backup TOTP token you can have it display if you have issues receiving the notification. It is quite a user friendly auth scheme, at least I've never had to resort to any kind of SMS backed auth.
- Kalium 7y agoIn my opinion, that sounds like precisely the sort of system that should not offer an SMS fallback unless the goal is to create a false sense of security in the user. But YMMV, I don't generally need to access my online banking applications when I don't have useful internet access. I tend to use TOTP for systems where I'm concerned about offline usage. But again, YMMV.