3 ms·
I signed up for OpenPhone just now, but then noticed that the only thing you need to log in to someone's account is their email and a 6 digit code emailed to th
by ivank 6y ago
I signed up for OpenPhone just now, but then noticed that the only thing you need to log in to someone's account is their email and a 6 digit code emailed to their account. There are no password or 2FA options. I haven't tested how rate-limited the login attempts are, but it seems like too much to ask for customers to trust that they exist and work, especially when the apparent attack success probability is already > 1/1M.
- toomuchtodo 6y agoYour access to your email account is your password (magic link-esq). Agreed that 2FA is desirable (not sure if it's on their roadmap, will have to ping them and ask). If 2FA is a hard requirement, building your own solution on top of Twilio is preferable (as they require 2FA).
- ivank 6y agoThanks. I agree with you, except a 6 digit code is worse than a good random password, or magic link with e.g. 64 bits of entropy.