8 ms·

To further expand on this. 2FA should not rely on SMS at all. It should be an option but not the default one. An Authenticator app should be the default. I know

To further expand on this. 2FA should not rely on SMS at all. It should be an option but not the default one. An Authenticator app should be the default. I know we assume everyone has a cell phone but that’s not the case.

fron 4y ago
WebAuthn should be the default
autoexec 4y ago
Authenticator apps aren't much better. Look at their privacy policies. Installing Microsoft Authenticator means giving them your location data 24/7 and allows the to collect even more data on you than giving Twitter your phone number did. Do you really think they aren't going to use that data for anything else? I don't believe that anymore than I believed Twitter. Personally, I'd rather deal with the hassle of carrying around multiple hardware tokens than give companies a continuous stream of data about my personal life to use against me.
- blueblimp 4y ago
  I use Microsoft Authenticator on iOS, and it doesn't use location. (I didn't even need to deny it--it didn't ask for it.)
  - crossroadsguy 4y ago
    They do ask on Android it seems. Not sure if this text is common across all apps seeking location permission. > Optional App functionality, Fraud prevention, security and compliance However I’m not surprised such apps keeping double standards between iOS and Androids. Apple spanks (or spanks harder) the apps that ask permissions frivolously or block functionality behind permissions unnecessarily just to collect data. For e.g I use TrueCaller on iOS without giving Contacts permission, but on Android the app features are blocked without it. Not sure of now but earlier Ola/Uber didn’t work on Android without location permission but on iOS they did and still do. Many such examples.
- C4K3 4y ago
  You don't have to use microsoft authenticator. TOTP is a big step up from SMS and most/good apps won't violate your privacy.
- viraptor 4y ago
  I believe GP meant authenticator app like authy, duo, or any other TOTP. You're not giving anyone your location by using that.
- hoppyhoppy2 4y ago
  There are free, open-source, and privacy-respecting options for TOTP 2FA that don't require a mobile phone plan. You can use something like KeepassXC (desktop) or something like KeepassDX or Aegis (on F-Droid on Android) for your OTP authentication app to manage 2FA for Google, Amazon, eBay, Dropbox, etc. and there are other options as well.
  - okamiueru 4y ago
    Just wanted to add emphasis on Aegis. I've been using Aegis for Google, GitLab, PSN, domain management. No issues. And it has zero permissions needed (aside from camera which is granted on a need basis for scanning qr codes). And also works fine without ever having a Internet connection.
    - nukemandan 4y ago
      plus one on this. https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
- bogwog 4y ago
  Afaik, TOTP is standardized, so you should be able to use any authenticator app for 2FA. Idk about Microsoft, but I haven't encountered any service that doesn't allow you to bring your own TOTP app.
  - yurishimo 4y ago
    I have. I worked for an enterprise that used OneLogin could only use the OneLogin Protect app for 2FA. I thought 1Password was broken but I tried a different app with my phone camera and it said the QR code was invalid.
    - stavros 4y ago
      That's configurable in OneLogin, your company just hadn't added more options. I added WebAuthn, Protect and TOTP just this morning.
  - fenmaz 4y ago
    Steam is another big one. They require you to use the Steam mobile app and it's the only way to do 2FA - no QR code. I've since dropped 2FA for Steam altogether.
    - boston_clone 4y ago
      This seems to have changed; you're able to use e-mail MFA (and is what I use for my account). Let's just hope they don't use _that_ for marketing purposes! ;)
      - cmeacham98 4y ago
        Actually, that option has existed forever, since even before the app-based MFA. However, if you use the "less secure" email MFA then steam places limits on your account that don't exist with the app MFA, like a forced delay on executing trades.
    - ThatPlayer 4y ago
      The Steam 2FA generation has been reverse engineered and you can use it in some password managers. Hardest part is extracting the secret https://bitwarden.com/help/authenticator-keys/#steam-guard-totps https://bitwarden.com/help/authenticator-keys/#steam-guard-t...
- andrewmackrodt 4y ago
  Are you using Microsoft Authenticator in a corporate environment/profile? I just checked my personal install (Android) and it does not require any permissions (location is denied).
  - autoexec 4y ago
    From the play store (https://play.google.com/store/apps/details?id=com.azure.authenticator https://play.google.com/store/apps/details?id=com.azure.auth...): This app has access to: Photos/Media/Files read the contents of your USB storage modify or delete the contents of your USB storage Location precise location (GPS and network-based) Contacts find accounts on the device Storage read the contents of your USB storage modify or delete the contents of your USB storage Camera take pictures and videos Identity find accounts on the device add or remove accounts Other receive data from Internet run at startup draw over other apps prevent device from sleeping create accounts and set passwords view network connections close other apps control vibration use accounts on the device full network access
    - andrewmackrodt 4y ago
      As with most (all?) Android apps, support for permission requires user consent; Camera, "Files and media" and Location are all set to "Not allowed" on my device. From what I can tell based on Microsoft's help page, location may be a requirement of a work/school account and as far as I can remember, I've never been prompted for the location permission - it's possible I denied access if I was, but the app works without it. From Microsoft's Authenticator help page: "You will see a prompt from Microsoft Authenticator asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources" https://support.microsoft.com/en-us/account-billing/common-questions-about-the-microsoft-authenticator-app-12d283d1-bcef-4875-9ae5-ac360e2945dd https://support.microsoft.com/en-us/account-billing/common-q...
      - angry_octet 4y ago
- WillPostForFood 4y ago
  So don't use Microsoft Authenticator. There are many options without the privacy problems with the MS App (which, IMO are overblown, but whatever). Go run your own if you want to be absolutely private. I'm happy with 1Password for managing it. http://www.nongnu.org/oath-toolkit/oathtool.1.html http://www.nongnu.org/oath-toolkit/oathtool.1.html
- koolba 4y ago
  Why does an Authenticator app even have location access? Geoblocking?
  - vel0city 4y ago
    Exactly, IIRC you can do policies related to locations. It's an optional feature, you don't need to enable it and the app will overall work just fine.
  - supertrope 4y ago
    In November 2021 an optional geolocation feature was added to MSFT Authenticator to allow admins to block foreign access. https://techcommunity.microsoft.com/t5/azure-active-directory-identity/new-microsoft-authenticator-security-features-are-now-available/ba-p/2464386 https://techcommunity.microsoft.com/t5/azure-active-director... https://support.microsoft.com/en-us/account-billing/common-questions-about-the-microsoft-authenticator-app-12d283d1-bcef-4875-9ae5-ac360e2945dd https://support.microsoft.com/en-us/account-billing/common-q...
  - autoexec 4y ago
    I wondered the same thing about needing access to the cameras and microphones. Turns out they justify it by saying it's for reading QR codes (as if phones had no other way to do this).
- __turbobrew__ 4y ago
  FreeOTP works just fine for me
- heavyset_go 4y ago
  Vaultwarden has TOTP support built in, and there are like a dozen open source TOTP authentication apps out there. There's no reason you have to use an app that invades your privacy for TOTP.
  - b112 4y ago
    Sadly, it uses rust nightly, making setup bleeding edge. And node, meaning it's a security nightmare. There are likely other options I guess, but for something of this level (keys to your, or a company's kingdom!), I'd want to see a project with an arm long history, loads of review, etc.
    - heavyset_go 4y ago
      The Vaultwarden I'm using uses stable Rust 1.60 and Node isn't involved at all.
      - b112 4y ago
        The build docs talk of the above.
        heavyset_go 4y ago
        Ah, good point. I'm able to build Vaultwarden with stable Rust, so maybe it's just a requirement for development. Vaultwarden lifts web-vault from Bitwarden, which uses Node, but you aren't required to run it with web-vault.
- scoot 4y ago
  Looking at settings, MS Authenticator hasn't ever requested location permission non my iPhone, and I'd be able to deny it if it had.
- rossjudson 4y ago
  What about your car? Most modern cars have connections to low bandwidth systems. Your phone? But I gotta ask. How are they using your personal data against you?
  - autoexec 4y ago
    My car is old enough to just have onstar which is physically disconnected. My phone I avoid adding personal data to (outside of messaging), I limit my browsing, and I've done what little I'm allowed to in terms of locking it down and removing unwanted features. Ultimately though, it's a necessary evil I'm still hoping to find a solution for. > But I gotta ask. How are they using your personal data against you? the answer is that they'll use your data against you in any way that they can if it works to their advantage in any way. Companies don't care about you and your needs, they care about themselves and making money. The reason there is a multi-billion dollar industry around the collecting, buying, and selling of even the most mundane aspects of your life is that companies have seen that all that data can be leveraged against you to give them money and power and one way or another that usually comes at your expense. Often they use the data they collect to manipulate you. Maybe they want to get to you buy something you wouldn't otherwise, maybe they want to shape your political opinions. Maybe they just sell your data out to others directly or they use that data to make it easier for others to exploit you. It doesn't matter if it's Facebook selling your data to Cambridge Analytica so that they can try to swing an election, a group of activists who buy up lists of people who have visited abortion clinics so they can harass them, or a company or data broker letting people buy lists of individuals with low IQs and poor education, or lists of people who are likely to suffer from dementia so they can be targeted with scams, it's all using the data you barely noticed you were handing over. Even when it's not intentional algorithms are constantly searching for ways to exploit you in the moment you're at your weakest. They can detect when someone who is bi-polar is entering a manic phase and push airline tickets to them since people in that state tend to make last minute travel plans. They can detect when you're tired, heartbroken, or under a lot of stress and anxiety and target you aggressively at those times using one trick after another to find whatever works best (both using what has worked for others like you and tailoring their methods to you individually), and they do it all without ever being explicitly programed to. The algorithms just maximize for results, and the ends justify the means while giving corporations plausible deniability for even the most egregiously exploitative means their algorithms employ. In the US, companies like Google, Microsoft, Facebook, your ISP and cell phone company routinely turn data over the state with both three letter agencies and local police departments sucking up all the data they can. It's a huge violation of our rights and a threat to our freedoms. Even the most well-intentioned company collecting your personal data is likely not doing enough to secure that data, and whatever data they hold onto is just waiting to be abused when a less scrupulous person takes over, or to be handed over when the company is bought or absorbed into another, or to be sold should the company ever go bankrupt or become desperate enough for the money. One way or another, the data you hand over will be used against you, and worse you'll have no idea when it happens. Today people are turned down for jobs and denied rental contracts because of the data collected on them. They are charged more for the same products they buy online than what other people are paying. They are told a company's polices are one thing, while other customers are told they are something else. Their insurance premiums are being raised based on this data. Companies have even been shown to use this data for things as trivial as leaving some people on hold longer than others, but nobody is ever told the reason why those things happen. You have most likely already paid more than someone else, had your time wasted, been denied something, been mislead, or been rejected based on the personal data you've handed over. Nobody is using your data to protect you or put more money in your pocket. It is always used to serve someone else regardless of what that does to you.
- mr_toad 4y ago
  > Installing Microsoft Authenticator means giving them your location data 24/7 On my iPhone settings it doesn’t seem like Microsoft Authenticator is accessing location data at all.
- ta988 4y ago
  You don't have to enable location permission. Unless there are some geo-fencing options I'm not using.
- KennyBlanken 4y ago
  That's not the problem with SMS for 2FA. The problem with SMS for 2FA is that cell phone accounts were never intended to serve as what amounts to a high security authenticator service, and cell phone companies are resistant to this newfound 'responsibility', somewhat understandably so. By default, someone can call up your cellular provider, claim to be you, pass trivial to no security questions, and request a replacement SIM be mailed out, or that your number be ported to another device. Or they can slip a bit of cash to any employee who works at any cell phone store that sells service for your carrier. SMS 2FA isn't better than just a password. It's objectively worse, dramatically increasing the attack surface. Compromise someone's cell phone account and you are virtually guaranteed access to their bank/retirement/investment accounts, email, social media, etc. And they are virtually powerless to do anything about it for at least a few hours while they scramble to, say, get phone service working again and rush to contact everyone they can think of. By the time you're able to even get to your bank to talk to a branch manager and show all sorts of proof of identity, your accounts could be long since cleaned out. Some providers finally are offering secondary passwords for porting/SIM replacement, that sort of thing. Absolutely call them and request your account be locked down as much as possible, ask to specify a secondary password, etc.
  - account42 4y ago
    > It's objectively worse, dramatically increasing the attack surface Any 2FA - no matter how weak - should in theory not be weaker than no 2FA. In practice of course these things can often be used as the only factor to "recover" access to an account so yes, weak 2FA like SMS can make things worse.
- nukemandan 4y ago
  I use the FOSS https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis and like it far better than other TOTP apps for the feature and UI
- jjav 4y ago
  > Authenticator apps aren't much better. Look at their privacy policies. For the most part, "authenticator app" means TOTP, which isn't proprietary. Which is beautiful because you don't actually need any app for it. Just save the TOTP seed. There are plenty open source implementations to compute the one-time code when you need it.
- broknbottle 4y ago
  Checkout Owky https://apps.apple.com/us/app/owky-two-factor-authenticator/id1602245257 https://apps.apple.com/us/app/owky-two-factor-authenticator/...
ChrisMarshallNY 4y ago
I just ordered something online, last night, and it had two required fields: 1) Mobile Phone (landline is not required) 2) The phone number/address needs to be the same as for the card. I don't use a mobile phone for the card. I use my landline, so I entered that.
- gabereiser 4y ago
  Yeah for those cases where phone is required I usually put (555)867-5309. They can spam someone else…
  - throwaway2037 4y ago
    Hat tip on the phone number. Ref: https://en.wikipedia.org/wiki/867-5309/Jenny https://en.wikipedia.org/wiki/867-5309/Jenny
wanderingmind 4y ago
Just wanted to give a shout out for Bitwarden. They have a fantastic TOTP 2FA as part of their premium solution (which is really just $10 per year)
- stavros 4y ago
  Agreed, and if like to second the *fuck SMS 2FA" stance. I've been locked out of my bank while abroad because I couldn't receive SMS.
ClassyJacket 4y ago
It's not just that not everyone has a mobile phone, people who move between different countries change numbers and lose access to their old one. I've been screwed over by this many times. You can't assume someone has the same phone number for their entire life.
bigiain 4y ago
"Telcos declare SMS 'unsafe' for bank transactions" https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for... And nothing has changed to make SMS any more secure since 2012...
- KennyBlanken 4y ago
  It's not just SMS that is the problem. Cell phone accounts were never intended to serve as high security authentication sources. It's laughably easy to take over a cell phone account, and once you do so, you likely crack open the victim's finances like an egg and leave them almost powerless to do anything about it before damage is done.
  - bigiain 4y ago
    That's a _feature_ for the telcos. They want you to be able to walk into a store, grab a new phone, and walk out several hundred dollars lighter with your old number already working on your shiny new phone. They want to make it as easy as possible to do that. They never signed up to be the gatekeepers to your digital life, and there's nobody paying them to do that. Expecting them to make their sales experience worse than their competitors just because some bank or crypto exchange can't work out a decent way to authenticate their customers is insane.
    - computerfriend 4y ago
      Not really, if I value it and would pay a higher price to use a telco that safeguards my number. Unfortunately, this (like much of security) is invisible to the consumer until it is too late.
mc4ndr3 4y ago
And port the dang 2FA apps to desktop. A tower or laptop is something you have. Don't depend so much onna damn phone for everything.
winternett 4y ago
Agreed. TikTok does this as well... I literally get spam calls just as I scroll though content there. Microsoft leaks numbers somehow as well, even on Enterprise service apps, as I used to get spam calls on company phones from authenticating on Azure all the time, when the numbers were totally private and used for business calls only. It's really a new form of torture to have to remember a really complex password and to do a TFA log in every time a change needs to be made now, one of my least likeable parts of modern jobs. It's not even like we had breaches, it just became mandatory and now a lot of things like cloud config go largely unchecked by admins because it's so tedious to log in so frequently and they often get locked out the minute they forget their phone at home because email is often another password/TFA hurdle... Stupid wins first these days. Breaches still happen elsewhere all the time despite TFA adoption as well, hackers keep engineering workarounds, and mobile security is compromised when personal devices are used anyway. A much better approach is in segmenting data, and only retaining essential/required data, but systems are made to collect far too many details on users and subject matter overreaching a "need to know" basis, which also dramatically increases the impact of modern data breaches. TFA used to be based on email and it was just fine. The only reason why phones became mandatory is precisely because of illicit use of phone contacts by these platforms. The bootleg calls also probably eats up tons of money in terms of prepaid minutes for people with those types of plans, yet whenever there is a fine, none of the affected people see true justice.
inglor_cz 4y ago
My experience is very much to the contrary. My phone with a Microsoft Authenticator app died and I still cannot access my MS account. In a similar way, it took me some time to get my smartbanking apps running again. If it was just SMS, I would move the SIM card elsewhere and hey-presto.
Mikeb85 4y ago
This. I regularly live in 2 different countries, Canadian cell plans are exorbitantly expensive when roaming so I have 2 phone numbers and its extremely annoying when 2FA relies on said phone number...

fron 4y ago

WebAuthn should be the default

autoexec 4y ago

Authenticator apps aren't much better. Look at their privacy policies. Installing Microsoft Authenticator means giving them your location data 24/7 and allows the to collect even more data on you than giving Twitter your phone number did. Do you really think they aren't going to use that data for anything else? I don't believe that anymore than I believed Twitter. Personally, I'd rather deal with the hassle of carrying around multiple hardware tokens than give companies a continuous stream of data about my personal life to use against me.

blueblimp 4y ago
I use Microsoft Authenticator on iOS, and it doesn't use location. (I didn't even need to deny it--it didn't ask for it.)
- crossroadsguy 4y ago
  They do ask on Android it seems. Not sure if this text is common across all apps seeking location permission. > Optional App functionality, Fraud prevention, security and compliance However I’m not surprised such apps keeping double standards between iOS and Androids. Apple spanks (or spanks harder) the apps that ask permissions frivolously or block functionality behind permissions unnecessarily just to collect data. For e.g I use TrueCaller on iOS without giving Contacts permission, but on Android the app features are blocked without it. Not sure of now but earlier Ola/Uber didn’t work on Android without location permission but on iOS they did and still do. Many such examples.
C4K3 4y ago
You don't have to use microsoft authenticator. TOTP is a big step up from SMS and most/good apps won't violate your privacy.
viraptor 4y ago
I believe GP meant authenticator app like authy, duo, or any other TOTP. You're not giving anyone your location by using that.
hoppyhoppy2 4y ago
There are free, open-source, and privacy-respecting options for TOTP 2FA that don't require a mobile phone plan. You can use something like KeepassXC (desktop) or something like KeepassDX or Aegis (on F-Droid on Android) for your OTP authentication app to manage 2FA for Google, Amazon, eBay, Dropbox, etc. and there are other options as well.
- okamiueru 4y ago
  Just wanted to add emphasis on Aegis. I've been using Aegis for Google, GitLab, PSN, domain management. No issues. And it has zero permissions needed (aside from camera which is granted on a need basis for scanning qr codes). And also works fine without ever having a Internet connection.
  - nukemandan 4y ago
    plus one on this. https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
bogwog 4y ago
Afaik, TOTP is standardized, so you should be able to use any authenticator app for 2FA. Idk about Microsoft, but I haven't encountered any service that doesn't allow you to bring your own TOTP app.
- yurishimo 4y ago
  I have. I worked for an enterprise that used OneLogin could only use the OneLogin Protect app for 2FA. I thought 1Password was broken but I tried a different app with my phone camera and it said the QR code was invalid.
  - stavros 4y ago
    That's configurable in OneLogin, your company just hadn't added more options. I added WebAuthn, Protect and TOTP just this morning.
- fenmaz 4y ago
  Steam is another big one. They require you to use the Steam mobile app and it's the only way to do 2FA - no QR code. I've since dropped 2FA for Steam altogether.
  - boston_clone 4y ago
    This seems to have changed; you're able to use e-mail MFA (and is what I use for my account). Let's just hope they don't use _that_ for marketing purposes! ;)
    - cmeacham98 4y ago
      Actually, that option has existed forever, since even before the app-based MFA. However, if you use the "less secure" email MFA then steam places limits on your account that don't exist with the app MFA, like a forced delay on executing trades.
  - ThatPlayer 4y ago
    The Steam 2FA generation has been reverse engineered and you can use it in some password managers. Hardest part is extracting the secret https://bitwarden.com/help/authenticator-keys/#steam-guard-totps https://bitwarden.com/help/authenticator-keys/#steam-guard-t...
andrewmackrodt 4y ago
Are you using Microsoft Authenticator in a corporate environment/profile? I just checked my personal install (Android) and it does not require any permissions (location is denied).
- autoexec 4y ago
  From the play store (https://play.google.com/store/apps/details?id=com.azure.authenticator https://play.google.com/store/apps/details?id=com.azure.auth...): This app has access to: Photos/Media/Files read the contents of your USB storage modify or delete the contents of your USB storage Location precise location (GPS and network-based) Contacts find accounts on the device Storage read the contents of your USB storage modify or delete the contents of your USB storage Camera take pictures and videos Identity find accounts on the device add or remove accounts Other receive data from Internet run at startup draw over other apps prevent device from sleeping create accounts and set passwords view network connections close other apps control vibration use accounts on the device full network access
  - andrewmackrodt 4y ago
    As with most (all?) Android apps, support for permission requires user consent; Camera, "Files and media" and Location are all set to "Not allowed" on my device. From what I can tell based on Microsoft's help page, location may be a requirement of a work/school account and as far as I can remember, I've never been prompted for the location permission - it's possible I denied access if I was, but the app works without it. From Microsoft's Authenticator help page: "You will see a prompt from Microsoft Authenticator asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources" https://support.microsoft.com/en-us/account-billing/common-questions-about-the-microsoft-authenticator-app-12d283d1-bcef-4875-9ae5-ac360e2945dd https://support.microsoft.com/en-us/account-billing/common-q...
    - angry_octet 4y ago
WillPostForFood 4y ago
So don't use Microsoft Authenticator. There are many options without the privacy problems with the MS App (which, IMO are overblown, but whatever). Go run your own if you want to be absolutely private. I'm happy with 1Password for managing it. http://www.nongnu.org/oath-toolkit/oathtool.1.html http://www.nongnu.org/oath-toolkit/oathtool.1.html
koolba 4y ago
Why does an Authenticator app even have location access? Geoblocking?
- vel0city 4y ago
  Exactly, IIRC you can do policies related to locations. It's an optional feature, you don't need to enable it and the app will overall work just fine.
- supertrope 4y ago
  In November 2021 an optional geolocation feature was added to MSFT Authenticator to allow admins to block foreign access. https://techcommunity.microsoft.com/t5/azure-active-directory-identity/new-microsoft-authenticator-security-features-are-now-available/ba-p/2464386 https://techcommunity.microsoft.com/t5/azure-active-director... https://support.microsoft.com/en-us/account-billing/common-questions-about-the-microsoft-authenticator-app-12d283d1-bcef-4875-9ae5-ac360e2945dd https://support.microsoft.com/en-us/account-billing/common-q...
- autoexec 4y ago
  I wondered the same thing about needing access to the cameras and microphones. Turns out they justify it by saying it's for reading QR codes (as if phones had no other way to do this).
__turbobrew__ 4y ago
FreeOTP works just fine for me
heavyset_go 4y ago
Vaultwarden has TOTP support built in, and there are like a dozen open source TOTP authentication apps out there. There's no reason you have to use an app that invades your privacy for TOTP.
- b112 4y ago
  Sadly, it uses rust nightly, making setup bleeding edge. And node, meaning it's a security nightmare. There are likely other options I guess, but for something of this level (keys to your, or a company's kingdom!), I'd want to see a project with an arm long history, loads of review, etc.
  - heavyset_go 4y ago
    The Vaultwarden I'm using uses stable Rust 1.60 and Node isn't involved at all.
    - b112 4y ago
      The build docs talk of the above.
      - heavyset_go 4y ago
        Ah, good point. I'm able to build Vaultwarden with stable Rust, so maybe it's just a requirement for development. Vaultwarden lifts web-vault from Bitwarden, which uses Node, but you aren't required to run it with web-vault.
scoot 4y ago
Looking at settings, MS Authenticator hasn't ever requested location permission non my iPhone, and I'd be able to deny it if it had.
rossjudson 4y ago
What about your car? Most modern cars have connections to low bandwidth systems. Your phone? But I gotta ask. How are they using your personal data against you?
- autoexec 4y ago
  My car is old enough to just have onstar which is physically disconnected. My phone I avoid adding personal data to (outside of messaging), I limit my browsing, and I've done what little I'm allowed to in terms of locking it down and removing unwanted features. Ultimately though, it's a necessary evil I'm still hoping to find a solution for. > But I gotta ask. How are they using your personal data against you? the answer is that they'll use your data against you in any way that they can if it works to their advantage in any way. Companies don't care about you and your needs, they care about themselves and making money. The reason there is a multi-billion dollar industry around the collecting, buying, and selling of even the most mundane aspects of your life is that companies have seen that all that data can be leveraged against you to give them money and power and one way or another that usually comes at your expense. Often they use the data they collect to manipulate you. Maybe they want to get to you buy something you wouldn't otherwise, maybe they want to shape your political opinions. Maybe they just sell your data out to others directly or they use that data to make it easier for others to exploit you. It doesn't matter if it's Facebook selling your data to Cambridge Analytica so that they can try to swing an election, a group of activists who buy up lists of people who have visited abortion clinics so they can harass them, or a company or data broker letting people buy lists of individuals with low IQs and poor education, or lists of people who are likely to suffer from dementia so they can be targeted with scams, it's all using the data you barely noticed you were handing over. Even when it's not intentional algorithms are constantly searching for ways to exploit you in the moment you're at your weakest. They can detect when someone who is bi-polar is entering a manic phase and push airline tickets to them since people in that state tend to make last minute travel plans. They can detect when you're tired, heartbroken, or under a lot of stress and anxiety and target you aggressively at those times using one trick after another to find whatever works best (both using what has worked for others like you and tailoring their methods to you individually), and they do it all without ever being explicitly programed to. The algorithms just maximize for results, and the ends justify the means while giving corporations plausible deniability for even the most egregiously exploitative means their algorithms employ. In the US, companies like Google, Microsoft, Facebook, your ISP and cell phone company routinely turn data over the state with both three letter agencies and local police departments sucking up all the data they can. It's a huge violation of our rights and a threat to our freedoms. Even the most well-intentioned company collecting your personal data is likely not doing enough to secure that data, and whatever data they hold onto is just waiting to be abused when a less scrupulous person takes over, or to be handed over when the company is bought or absorbed into another, or to be sold should the company ever go bankrupt or become desperate enough for the money. One way or another, the data you hand over will be used against you, and worse you'll have no idea when it happens. Today people are turned down for jobs and denied rental contracts because of the data collected on them. They are charged more for the same products they buy online than what other people are paying. They are told a company's polices are one thing, while other customers are told they are something else. Their insurance premiums are being raised based on this data. Companies have even been shown to use this data for things as trivial as leaving some people on hold longer than others, but nobody is ever told the reason why those things happen. You have most likely already paid more than someone else, had your time wasted, been denied something, been mislead, or been rejected based on the personal data you've handed over. Nobody is using your data to protect you or put more money in your pocket. It is always used to serve someone else regardless of what that does to you.
mr_toad 4y ago
> Installing Microsoft Authenticator means giving them your location data 24/7 On my iPhone settings it doesn’t seem like Microsoft Authenticator is accessing location data at all.
ta988 4y ago
You don't have to enable location permission. Unless there are some geo-fencing options I'm not using.
KennyBlanken 4y ago
That's not the problem with SMS for 2FA. The problem with SMS for 2FA is that cell phone accounts were never intended to serve as what amounts to a high security authenticator service, and cell phone companies are resistant to this newfound 'responsibility', somewhat understandably so. By default, someone can call up your cellular provider, claim to be you, pass trivial to no security questions, and request a replacement SIM be mailed out, or that your number be ported to another device. Or they can slip a bit of cash to any employee who works at any cell phone store that sells service for your carrier. SMS 2FA isn't better than just a password. It's objectively worse, dramatically increasing the attack surface. Compromise someone's cell phone account and you are virtually guaranteed access to their bank/retirement/investment accounts, email, social media, etc. And they are virtually powerless to do anything about it for at least a few hours while they scramble to, say, get phone service working again and rush to contact everyone they can think of. By the time you're able to even get to your bank to talk to a branch manager and show all sorts of proof of identity, your accounts could be long since cleaned out. Some providers finally are offering secondary passwords for porting/SIM replacement, that sort of thing. Absolutely call them and request your account be locked down as much as possible, ask to specify a secondary password, etc.
- account42 4y ago
  > It's objectively worse, dramatically increasing the attack surface Any 2FA - no matter how weak - should in theory not be weaker than no 2FA. In practice of course these things can often be used as the only factor to "recover" access to an account so yes, weak 2FA like SMS can make things worse.
nukemandan 4y ago
I use the FOSS https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis and like it far better than other TOTP apps for the feature and UI
jjav 4y ago
> Authenticator apps aren't much better. Look at their privacy policies. For the most part, "authenticator app" means TOTP, which isn't proprietary. Which is beautiful because you don't actually need any app for it. Just save the TOTP seed. There are plenty open source implementations to compute the one-time code when you need it.
broknbottle 4y ago
Checkout Owky https://apps.apple.com/us/app/owky-two-factor-authenticator/id1602245257 https://apps.apple.com/us/app/owky-two-factor-authenticator/...

ChrisMarshallNY 4y ago

I just ordered something online, last night, and it had two required fields: 1) Mobile Phone (landline is not required) 2) The phone number/address needs to be the same as for the card. I don't use a mobile phone for the card. I use my landline, so I entered that.

gabereiser 4y ago
Yeah for those cases where phone is required I usually put (555)867-5309. They can spam someone else…
- throwaway2037 4y ago
  Hat tip on the phone number. Ref: https://en.wikipedia.org/wiki/867-5309/Jenny https://en.wikipedia.org/wiki/867-5309/Jenny

wanderingmind 4y ago

Just wanted to give a shout out for Bitwarden. They have a fantastic TOTP 2FA as part of their premium solution (which is really just $10 per year)

stavros 4y ago
Agreed, and if like to second the *fuck SMS 2FA" stance. I've been locked out of my bank while abroad because I couldn't receive SMS.

ClassyJacket 4y ago

It's not just that not everyone has a mobile phone, people who move between different countries change numbers and lose access to their old one. I've been screwed over by this many times. You can't assume someone has the same phone number for their entire life.

bigiain 4y ago

"Telcos declare SMS 'unsafe' for bank transactions" https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for... And nothing has changed to make SMS any more secure since 2012...

KennyBlanken 4y ago
It's not just SMS that is the problem. Cell phone accounts were never intended to serve as high security authentication sources. It's laughably easy to take over a cell phone account, and once you do so, you likely crack open the victim's finances like an egg and leave them almost powerless to do anything about it before damage is done.
- bigiain 4y ago
  That's a _feature_ for the telcos. They want you to be able to walk into a store, grab a new phone, and walk out several hundred dollars lighter with your old number already working on your shiny new phone. They want to make it as easy as possible to do that. They never signed up to be the gatekeepers to your digital life, and there's nobody paying them to do that. Expecting them to make their sales experience worse than their competitors just because some bank or crypto exchange can't work out a decent way to authenticate their customers is insane.
  - computerfriend 4y ago
    Not really, if I value it and would pay a higher price to use a telco that safeguards my number. Unfortunately, this (like much of security) is invisible to the consumer until it is too late.

mc4ndr3 4y ago

And port the dang 2FA apps to desktop. A tower or laptop is something you have. Don't depend so much onna damn phone for everything.

winternett 4y ago

Agreed. TikTok does this as well... I literally get spam calls just as I scroll though content there. Microsoft leaks numbers somehow as well, even on Enterprise service apps, as I used to get spam calls on company phones from authenticating on Azure all the time, when the numbers were totally private and used for business calls only. It's really a new form of torture to have to remember a really complex password and to do a TFA log in every time a change needs to be made now, one of my least likeable parts of modern jobs. It's not even like we had breaches, it just became mandatory and now a lot of things like cloud config go largely unchecked by admins because it's so tedious to log in so frequently and they often get locked out the minute they forget their phone at home because email is often another password/TFA hurdle... Stupid wins first these days. Breaches still happen elsewhere all the time despite TFA adoption as well, hackers keep engineering workarounds, and mobile security is compromised when personal devices are used anyway. A much better approach is in segmenting data, and only retaining essential/required data, but systems are made to collect far too many details on users and subject matter overreaching a "need to know" basis, which also dramatically increases the impact of modern data breaches. TFA used to be based on email and it was just fine. The only reason why phones became mandatory is precisely because of illicit use of phone contacts by these platforms. The bootleg calls also probably eats up tons of money in terms of prepaid minutes for people with those types of plans, yet whenever there is a fine, none of the affected people see true justice.

inglor_cz 4y ago

My experience is very much to the contrary. My phone with a Microsoft Authenticator app died and I still cannot access my MS account. In a similar way, it took me some time to get my smartbanking apps running again. If it was just SMS, I would move the SIM card elsewhere and hey-presto.

Mikeb85 4y ago

This. I regularly live in 2 different countries, Canadian cell plans are exorbitantly expensive when roaming so I have 2 phone numbers and its extremely annoying when 2FA relies on said phone number...