3 ms·

>> two-factor authentication with or without consent, is now more important than customer satisfaction and good-will. I'm sorry, but what sort of pointless stu

>> two-factor authentication with or without consent, is now more important than customer satisfaction and good-will. I'm sorry, but what sort of pointless stupid rant is this ? Its 2020, surely as a contributor here on ycombinator, you must be tech-savvy enough to know how much of an increasingly GOOD THING(TM) two-factor authentication is in this era of key-loggers, phishing etc. etc. ? No doubt you would be the first person to start shouting from your rooftop with false claims about how bad Apple's security was when your account got hacked, carefully ignoring the fact you had not bothered to turn on 2FA.

throw97543 6y ago
Two-factor is fine as long as SMS isn’t the only way for the second factor. Not to mention, many times, SMS becomes the only factor.
ryukafalz 6y ago
2FA is great, but the only options Apple provides for 2FA are SMS/call and a proprietary 2FA that only works if you have an iDevice. If you don't own one and you don't want to give Apple your phone number, tough luck. Neither TOTP nor FIDO2 is an option, as they would be for most other accounts.
- cmehdy 6y ago
  2FA through SMS is unfortunately the norm.. I own a "dumb" phone and a yubikey, and guess what: 95% of servies online from Jira to Uber or Instagram/Facebook will not let you use a yubikey without setting SMS as the main and first recovery process, and sometimes just not let you use a yubikey at all anyway. Which is absurd in 2020 but apparently that's still where we're at. IIRC Github, Bitwarden and Google have done a good job with that and my yubikey can at least be put to good use there.
  - ryukafalz 6y ago
    It hasn't been quite that bad in my experience, but perhaps I've gotten lucky re: the services I use. (But yeah Facebook... their track record here is not great: https://techcrunch.com/2018/09/27/yes-facebook-is-using-your-2fa-phone-number-to-target-you-with-ads/ https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...) I have a mobile plan that only works within the US, and I just buy a temporary SIM whenever I travel - meaning I have a completely different phone number until I get back. If I had to get into my iCloud account for whatever reason while traveling overseas and I was using an Android phone at the time, I probably would not have been able to.
dvfjsdhgfv 6y ago
Why not give people a choice? Push everybody but give them an option not to? There are a few devices I specifically don't want to turn 2FA on, but someone else made that decision for me.
- nabla9 6y ago
  If you give people one choice, you have 2 different user cases to deal with. If you give people choice over two two separate, you have now 4 different casess... Companies like Apple limit the choices so that they can provide single user experience. Users are bulk mass for them, not individuals. If you use Apple products, you are paying for not to have a choice.
TheRealSteel 6y ago
Requiring two factor authentication via SMS is not acceptable and should be downright illegal. I will never use it unless I have absolutely no choice. It completely discounts all the people that ever leave one country and spend time in another, and I've been permanently banned from some apps (Tinder was one) just because they have absolutely no option, support, or recourse if you can't access your old phone number. No, American Tech Company, I will not be quitting my job, spending 20,000$ and a month of my life on plane tickets and sitting in hotel quarantine just to get an SMS just because you it didn't occur to you that sometimes people are in a different country to the country they were in before.

throw97543 6y ago

Two-factor is fine as long as SMS isn’t the only way for the second factor. Not to mention, many times, SMS becomes the only factor.

ryukafalz 6y ago

2FA is great, but the only options Apple provides for 2FA are SMS/call and a proprietary 2FA that only works if you have an iDevice. If you don't own one and you don't want to give Apple your phone number, tough luck. Neither TOTP nor FIDO2 is an option, as they would be for most other accounts.

cmehdy 6y ago
2FA through SMS is unfortunately the norm.. I own a "dumb" phone and a yubikey, and guess what: 95% of servies online from Jira to Uber or Instagram/Facebook will not let you use a yubikey without setting SMS as the main and first recovery process, and sometimes just not let you use a yubikey at all anyway. Which is absurd in 2020 but apparently that's still where we're at. IIRC Github, Bitwarden and Google have done a good job with that and my yubikey can at least be put to good use there.
- ryukafalz 6y ago
  It hasn't been quite that bad in my experience, but perhaps I've gotten lucky re: the services I use. (But yeah Facebook... their track record here is not great: https://techcrunch.com/2018/09/27/yes-facebook-is-using-your-2fa-phone-number-to-target-you-with-ads/ https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...) I have a mobile plan that only works within the US, and I just buy a temporary SIM whenever I travel - meaning I have a completely different phone number until I get back. If I had to get into my iCloud account for whatever reason while traveling overseas and I was using an Android phone at the time, I probably would not have been able to.

dvfjsdhgfv 6y ago

Why not give people a choice? Push everybody but give them an option not to? There are a few devices I specifically don't want to turn 2FA on, but someone else made that decision for me.

nabla9 6y ago
If you give people one choice, you have 2 different user cases to deal with. If you give people choice over two two separate, you have now 4 different casess... Companies like Apple limit the choices so that they can provide single user experience. Users are bulk mass for them, not individuals. If you use Apple products, you are paying for not to have a choice.

TheRealSteel 6y ago

Requiring two factor authentication via SMS is not acceptable and should be downright illegal. I will never use it unless I have absolutely no choice. It completely discounts all the people that ever leave one country and spend time in another, and I've been permanently banned from some apps (Tinder was one) just because they have absolutely no option, support, or recourse if you can't access your old phone number. No, American Tech Company, I will not be quitting my job, spending 20,000$ and a month of my life on plane tickets and sitting in hotel quarantine just to get an SMS just because you it didn't occur to you that sometimes people are in a different country to the country they were in before.