3 ms·
I think this is good advice but it also shows why using TOTP as a default 2FA mechanism (instead of SMS) is a tough sell. How many people are set up to store a
by g_sch 4y ago
I think this is good advice but it also shows why using TOTP as a default 2FA mechanism (instead of SMS) is a tough sell. How many people are set up to store a TOTP seed in a location other than their authenticator app? How many people even know what a TOTP seed is? I would wager that the vast majority of non-HN readers think of TOTP as a QR code that you scan into an authenticator app, if they are even familiar with authenticator apps.
SMS, for all its security shortcomings, is at least something that the vast majority of people understand already.
- gabereiser 4y agoEmail would be preferred. SMS shouldn’t be the default. If I lost my TOTP tokens, I should be able to go through a tougher path with an email verification step to get in to redo my tokens. What I don’t want is for them to send me an SMS to verify me. What if I’m in a different country? What if I don’t have cell service? What if I don’t have access to my phone and that’s why I’m rotating all my stuff?
- jjav 4y ago> SMS, for all its security shortcomings, is at least something that the vast majority of people understand already. But of course SMS suffers of the same problems as naive use of TOTP: Lose your phone, you're locked out of every account you have. So in the worst case, TOTP is as bad as SMS. But, with some awareness/education TOTP is far superior if the user doesn't fall into the trap of attaching the TOTP seed to a phone. i.e. for the aware user, TOTP is far better. For the naive user, TOTP is no worse than SMS. Thus, always favor TOTP.