4 ms·

As someone who occasionally moves countries, this is horrifying. Did you enable 2FA and still need to authenticate via text? I used to enable 2FA, but got wor

by KMag 6y ago

As someone who occasionally moves countries, this is horrifying. Did you enable 2FA and still need to authenticate via text? I used to enable 2FA, but got worried about phone loss/damage.

koolba 6y ago
Do they even let you enable non-SMA 2FA anymore? Last I checked the TOTP option was gone.
- viraptor 6y ago
  On Google? Both totp and second device authentication are still supported.
  - donmcronald 6y ago
    Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those methods with some other arbitrary factors to make it really secure. Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!
    - geofft 6y ago
      In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.
    - viraptor 6y ago
      > Now there are 4 ways to compromise your account. No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page. They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.
- nucleardog 6y ago
  Yes, but first you have to enable SMS 2FA. When you set up MFA, it doesn't provide TOTP as an option. If you enable it with a phone number/SMS MFA, you can go back into the MFA options and add a TOTP device then remove the SMS option. Of course, at that point they still have your phone number...
jdeibele 6y ago
It's been a couple of years but I was able to set up 2FA for security keys (Yubikey and HyperSecu) and Authy (same as Google Authenticator but allows me to user more than one device to authorize). I then removed the phone number and backup email address.

by KMag 6y ago

As someone who occasionally moves countries, this is horrifying. Did you enable 2FA and still need to authenticate via text? I used to enable 2FA, but got worried about phone loss/damage.

koolba 6y ago

Do they even let you enable non-SMA 2FA anymore? Last I checked the TOTP option was gone.

viraptor 6y ago
On Google? Both totp and second device authentication are still supported.
- donmcronald 6y ago
  Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those methods with some other arbitrary factors to make it really secure. Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!
  - geofft 6y ago
    In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.
  - viraptor 6y ago
    > Now there are 4 ways to compromise your account. No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page. They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.
nucleardog 6y ago
Yes, but first you have to enable SMS 2FA. When you set up MFA, it doesn't provide TOTP as an option. If you enable it with a phone number/SMS MFA, you can go back into the MFA options and add a TOTP device then remove the SMS option. Of course, at that point they still have your phone number...

jdeibele 6y ago

It's been a couple of years but I was able to set up 2FA for security keys (Yubikey and HyperSecu) and Authy (same as Google Authenticator but allows me to user more than one device to authorize). I then removed the phone number and backup email address.