3 ms·
but convenient :) I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.
by virtue3 6y ago
but convenient :)
I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.
- StavrosK 6y agoNot as convenient as having no second factor, and less secure!
- zucker42 6y agoHow is it less secure than no second factor?
- StavrosK 6y agoThere have been many instances of attacks of people hijacking the connection, calling the service and saying "I forgot my password, can you reset it by verifying my SMS?", which wouldn't have been possible without a second factor.
- joveian 6y agoI wish someone would convince Paypal. They require SMS for verification, no other options at all.
- draebek 6y agoI think they offer TOTP now, right? Started sometime last year? Do you have to activate SMS alongside it? I have been using TOTP with PayPal for (I think) a few years now. You used to have to run some weird local Python script that somehow imitated the one RSA (I think) dongle they supported in a way I don't understand, but the net result was that you just get a TOTP key that works fine.
- joveian 6y agoMultiple Paypal reps told me that SMS is the only way. It is possible they are all incorrect :/. I'll look into it, thanks.
- tialaramex 6y agoI wasn't able to see any way to do even TOTP for PayPal when they insisted I enable SMS a few hours ago. I don't have any money in there, it just mediates broken payment interfaces (e.g. Patreon rejected all my payment cards, from multiple banks apparently they're all fraud or something? No idea, the cards remain working no problem everywhere else, but I wanted to give people money for what they do, so I used Paypal to manage that) It's pretty sad that in 2020 PayPal thinks SMS is a reasonable choice for protecting accounts that might actually have money in them...
- draebek 6y agoCheck the instructions at https://authy.com/guides/paypal/ https://authy.com/guides/paypal/. Those seem to work for me, I can indeed now add an authenticator app just as shown there.
- joveian 6y agoThanks, I think it worked. At least they are no longer asking me to confirm the mobile number, although I can't seem to delete the unconfirmed number so who knows if there is still a way to use it to take over the account :(. Along the way I found a disturbing number of TOTP utilities that want you to pass the key on the command line :(. I found this one as a simple version that doesn't do that and uses OpenSSL or LibreSSL: https://github.com/arachsys/totp https://github.com/arachsys/totp
- joveian 6y agoNope, didn't fully work. The still won't let me add a credit card without receiving a text.
- nicoburns 6y agoI'd argue that it isn't truly a second factor if it can be used on it own...
- StavrosK 6y agoAnd that's much of the problem.