4 ms·
It's because people lose access to their phone number rarely. It would be pretty much expected for somebody to not realize their Google Authenticator codes aren
by weird-eye-issue 6y ago
It's because people lose access to their phone number rarely. It would be pretty much expected for somebody to not realize their Google Authenticator codes aren't backed up before losing/selling their phone or losing their Yubikey before backing up the private key off it. As somebody who doesn't use SMS 2FA, I still think it's a great middle ground for the average user.
- loloquwowndueo 6y agoUntrue. Particularly in emerging economies where prepaid is much more common, it’s quite normal for people whose phone becomes unavailable to just buy a new one with an entirely new number and just tell everyone their number has changed.
- gruez 6y agoemerging economies don't have number porting?
- loloquwowndueo 6y agoThey do, but a lot of people don’t bother and just get a new number along with the new phone.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- weird-eye-issue 6y agoThen they wouldn't use their temporary number for 2FA. But for a lot of people they have their number for decades and are not going to suddenly lose it as easily as you can drop your phone into the ocean.
- pilsetnieks 6y agoThey finally updated Google Authenticator to enable backups and transfers between devices in December last year.[1] Also, there are other 2FA apps like Authy that are more user friendly and have been transferrable for years now. However, I think you do have a point. The attacks that rely on intercepting SMS messages are cumbersome and are really feasible only for high value targets. [1] https://www.androidpolice.com/2020/05/07/google-authenticator-gets-its-first-update-in-years-finally-lets-you-transfer-accounts-between-devices-apk-download/ https://www.androidpolice.com/2020/05/07/google-authenticato...
- jsjohnst 6y ago> The attacks that rely on intercepting SMS messages are cumbersome and are really feasible only for high value targets. Depends on your definition of cumbersome, but it can be done fairly trivially[1] if you know what you’re doing. [1] https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...
- toastal 6y agoThe recommended alternative to Google’s proprietary authenticator is MIT-licensed andOTP. The app is also available on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/