4 ms·

I used to be quite annoyed with 2FA (although I understood the value)... and was particularly annoyed when one of my banks made 2FA mandatory. Begrudgingly shl

by Alupis 6y ago

I used to be quite annoyed with 2FA (although I understood the value)... and was particularly annoyed when one of my banks made 2FA mandatory. Begrudgingly shlupping myself to the other room to locate my phone and get a texted code... But, after receiving 3 different password reset emails in a short period for different services, I decided to enable 2FA for everything that supports it. Where possible, choosing the Time Based 2FA instead of texting codes (just in case I lose my phone or something). With the right mindset (and paranoia), I'm coming around to viewing this inconvenience as necessary, and wish more services supported it.

snazz 6y ago
The kind that Google and Microsoft (and maybe others) do is pretty great. You get a push notification on your phone and just tap "Yes", and you're in. Of course, you should still have a fallback like OTP for when your phone is not internet-connected, but it feels really seamless and is a very minor inconvenience.
PascLeRasc 6y ago
If you have 1Password it makes software-based 2FA so easy that you'll barely notice it's on. Though I haven't been able to find a single US bank that supports software 2FA.
- ganstyles 6y ago
  Does 1Pass support 2FA or otherwise handle it? I have been using 1Pass for years, but use a different app for my MFA.
  - PascLeRasc 6y ago
    Yep. If you have the desktop app installed, look for Two-Factor Authentication under Watchtower and it'll tell you all the sites that can use it. It's easy to set up too, it can scan a QR code on your screen. Some people believe that it's more secure to not mix your password manager with your 2FA though, since it's not "true 2FA".
  - developer2 6y ago
    You could also look at Bitwarden. I'm not affiliated, but it's an amazing password manager (desktop app, mobile apps, browser extensions). Even better, it's fully open source; you can even run your own server to keep out a third-party being your (encrypted) sync server. I've been using it for a couple of years now, and have never had a single problem. Free for personal use of almost everything… an upgrade to include the two-factor auth you're looking for is a very cheap $10/year.
packet_nerd 6y ago
I got a little U2F token that I leave plugged into my laptop and set it up on everything that supports it. It's really nice because you don't have to stop and hunt down a code, or a phone or app, just tap the side and it lets you in. I just wish more sites supported it. In terms of both UX and authentication strength it's infinitely better than SMS/email/TOTP 2FA in every way. (My understanding is most alternatives, including SMS and google auth type TOTP, are still vulnerable to MitM attacks whereas U2F tokens solve that too).

by Alupis 6y ago

snazz 6y ago

The kind that Google and Microsoft (and maybe others) do is pretty great. You get a push notification on your phone and just tap "Yes", and you're in. Of course, you should still have a fallback like OTP for when your phone is not internet-connected, but it feels really seamless and is a very minor inconvenience.

PascLeRasc 6y ago

If you have 1Password it makes software-based 2FA so easy that you'll barely notice it's on. Though I haven't been able to find a single US bank that supports software 2FA.

ganstyles 6y ago
Does 1Pass support 2FA or otherwise handle it? I have been using 1Pass for years, but use a different app for my MFA.
- PascLeRasc 6y ago
  Yep. If you have the desktop app installed, look for Two-Factor Authentication under Watchtower and it'll tell you all the sites that can use it. It's easy to set up too, it can scan a QR code on your screen. Some people believe that it's more secure to not mix your password manager with your 2FA though, since it's not "true 2FA".
- developer2 6y ago
  You could also look at Bitwarden. I'm not affiliated, but it's an amazing password manager (desktop app, mobile apps, browser extensions). Even better, it's fully open source; you can even run your own server to keep out a third-party being your (encrypted) sync server. I've been using it for a couple of years now, and have never had a single problem. Free for personal use of almost everything… an upgrade to include the two-factor auth you're looking for is a very cheap $10/year.

packet_nerd 6y ago

I got a little U2F token that I leave plugged into my laptop and set it up on everything that supports it. It's really nice because you don't have to stop and hunt down a code, or a phone or app, just tap the side and it lets you in. I just wish more sites supported it. In terms of both UX and authentication strength it's infinitely better than SMS/email/TOTP 2FA in every way. (My understanding is most alternatives, including SMS and google auth type TOTP, are still vulnerable to MitM attacks whereas U2F tokens solve that too).