35 ms·
Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app. Like Microsoft Authenticator. It wanted way too
by heroprotagonist 6y ago
Beyond it being insecure, I see it used too often as the only alternative to yet another proprietary MFA app.
Like Microsoft Authenticator. It wanted way too many permissions on my phone, and provided less security than my Yubikey authenticator. My yubikey provides a standard open OTP but requires the device to generate it (phone tap or plugin via USB to computer or phone).
Open standards are better. I don't want a different authenticator app for every website. It's so much simpler to use a single app.
- corty 6y agoMicrosoft Authenticator can be replaced by any app that does standard OTP, e.g. FreeOTP+.
- heroprotagonist 6y agoOh nice, I just checked my account and it has the option now. It didn't when I last looked a couple years ago. I'm glad they added this. Thanks for the heads up! Still, the principle stands for a number of other sites. eg, Steam (using their app or email), Twitch (authy or bust), etc. I'd rather use an open standard than be limited to a custom or specific authenticator.
- sodality2 6y agoTOTP is definitely an open standard. https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238