4 ms·
One thing I don't understand about the suggestion to remove my phone number from 2FA is that 1FA seems worse. I'd prefer something like Google authenticator, bu
by ndesaulniers 5y ago
One thing I don't understand about the suggestion to remove my phone number from 2FA is that 1FA seems worse. I'd prefer something like Google authenticator, but none of my banks offer that. Did I misunderstand the suggestion? Is there something else I should do?
- chinathrow 5y ago> but none of my banks offer that. Did I misunderstand the suggestion? Is there something else I should do? Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. If you really need to keep that account for reason X, move out all your assets to another bank and keep enough funds to fund X there.
- kube-system 5y ago> Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. Have any suggestions for a bank that supports TOTP? I have yet to find a decent bank in the US that supports this.
- vdqtp3 5y agoFirst Tech Federal Credit Union and Fidelity both support time/token based auth although it's Entrust or Symantec VIP, not open TOTP
- kube-system 5y agoI really wish there was some bank would support plain TOTP. I don't want 5 different solutions to managing my TOTP tokens. I already have one.
- closeparen 5y agoPhone support at Fidelity will turn off VIP for you as long as you can answer at the account phone number.
- foobiekr 5y agothis and they are not alone, it's horrible
- chinathrow 5y agoI am not in the US but I'm sure fellow HNers can help you out.
- gnopgnip 5y agohttps://web.archive.org/web/20200202222301/https://twofactorauth.org/#banking https://web.archive.org/web/20200202222301/https://twofactor... has a list of large banks and 2fa methods. Charles Schwab and USAA use TOTP but aren't exactly main stream banks. Both use a Symantec client and don't officially support third party authenticator apps.
- ndesaulniers 5y agoThanks for the link! A more updated source seems to be hosted at https://2fa.directory/#banking https://2fa.directory/#banking currently. Not too many banks with physical locations in my area AND 2FA more secure than SMS.
- deleted 5y ago[deleted]
- PeterisP 5y agoThe problem is that often adding the phone number just says "2FA" but in reality becomes as another single authentication factor (e.g. in credential reset workflow) - and, given the risk of SIM swap, it may be weaker than proper 1FA e.g. a good password.