2 ms·

I have nothing against you, but I wish more people would get burn by the sms 2fa without backup/alternatives. Maybe at some point we will realize that it's a t

by throw20190125 7y ago

I have nothing against you, but I wish more people would get burn by the sms 2fa without backup/alternatives. Maybe at some point we will realize that it's a terrible idea.

bdcravens 7y ago
I actually agree with you. Aside from apps that don't offer anything other than SMS 2FA, I always opt for TOTP-based 2FA. However, one compromise I've made is with Authy: they back up your saved config, but you must SMS verify (or have it installed on a 2nd device to verify a new device)
- tubbs 7y ago
  If you're comfortable with a paid option, consider StandardNotes' TokenVault: https://standardnotes.org/extensions/tokenvault https://standardnotes.org/extensions/tokenvault
pesfandiar 7y ago
Any 2FA is inherently susceptible to losing one of the factors. It's designed to deny access when only one factor is present, so this is kind of a feature not a bug, and part of the security-vs-convenience tradeoff. Do you have any specific reason to think SMS 2FA in particular is a terrible idea?
- adtac 7y ago
  Not if you have a password-protected Yubikey with GPG/RSA signing, encryption, and authentication keys and a second backup Yubikey with the same keys. If you lose one, order two more ASAP, use the backup key to change your keys in every machine and revoke that key (thereby rendering the lost Yubikey and your backup useless). Wait for the new Yubikeys to arrive, generate new keys, change all machines to these new keys, and revoke the temporary keys you generated.
- huanwin 7y ago
  For 2FA specifically, SMS is weak because of its vulnerability to SIM swap attacks[0]. There's been a few reported incidents where attackers stole cryptocurrency from accounts protected by SMS 2FA[1]. [0]: https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam [1]: https://btcmanager.com/sim-swap-attacks-amplify-companies-recommend-using-sms-2fa/?q=/sim-swap-attacks-amplify-companies-recommend-using-sms-2fa/& https://btcmanager.com/sim-swap-attacks-amplify-companies-re...

I have nothing against you, but I wish more people would get burn by the sms 2fa without backup/alternatives. Maybe at some point we will realize that it's a terrible idea.

bdcravens 7y ago

I actually agree with you. Aside from apps that don't offer anything other than SMS 2FA, I always opt for TOTP-based 2FA. However, one compromise I've made is with Authy: they back up your saved config, but you must SMS verify (or have it installed on a 2nd device to verify a new device)

tubbs 7y ago
If you're comfortable with a paid option, consider StandardNotes' TokenVault: https://standardnotes.org/extensions/tokenvault https://standardnotes.org/extensions/tokenvault

pesfandiar 7y ago

Any 2FA is inherently susceptible to losing one of the factors. It's designed to deny access when only one factor is present, so this is kind of a feature not a bug, and part of the security-vs-convenience tradeoff. Do you have any specific reason to think SMS 2FA in particular is a terrible idea?

adtac 7y ago
Not if you have a password-protected Yubikey with GPG/RSA signing, encryption, and authentication keys and a second backup Yubikey with the same keys. If you lose one, order two more ASAP, use the backup key to change your keys in every machine and revoke that key (thereby rendering the lost Yubikey and your backup useless). Wait for the new Yubikeys to arrive, generate new keys, change all machines to these new keys, and revoke the temporary keys you generated.
huanwin 7y ago
For 2FA specifically, SMS is weak because of its vulnerability to SIM swap attacks[0]. There's been a few reported incidents where attackers stole cryptocurrency from accounts protected by SMS 2FA[1]. [0]: https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam [1]: https://btcmanager.com/sim-swap-attacks-amplify-companies-recommend-using-sms-2fa/?q=/sim-swap-attacks-amplify-companies-recommend-using-sms-2fa/& https://btcmanager.com/sim-swap-attacks-amplify-companies-re...