3 ms·
Show me a TOTP implementation that doesn’t require a phone number to sign up for or initialize… IME, they not only require a phone number at setup but, further
by rsync 4y ago
Show me a TOTP implementation that doesn’t require a phone number to sign up for or initialize…
IME, they not only require a phone number at setup but, further, reject VOIP/twilio numbers.
This shows that it’s not at all about security, but about slowing (but not solving) their brutal, unrelenting, spam and sock puppet problems.
EDIT: Thanks - very interesting. I guess I am jaded by my experiences with 'authy' and twilio, etc.
- roblabla 4y agoTOTP never requires a phone number. On GitHub, they either show you a qr code you can scan in an app, or a text you can import. All apps support this sign up process, from google authenticator to console-based tools like totp[0]. Other 2FA implementations may require phone numbers. But HOTP and TOTP don't. [0]: https://github.com/arcanericky/totp https://github.com/arcanericky/totp
- istillwritecode 4y agoTOTP itself doesn't require a phone number, but the Authy phone app from Twilio managed to screw up their TOTP implementation and it requires a phone number. I filed a bug with them and they finally acknowledged that it's deeply embedded in their implementation.
- vel0city 4y agoWell, for starters, Github. I don't have a phone number on file with them and I have TOTP and FIDO available. The vast majority of sites I use TOTP on didn't require a phone number for the account.