4 ms·
It's almost sort of endearing, but not actually. The fact that they use SMS-based 2FA (at least through 2021) is a travesty and a bit concerning, though. Edit:
by parkaboy 4y ago
It's almost sort of endearing, but not actually. The fact that they use SMS-based 2FA (at least through 2021) is a travesty and a bit concerning, though.
Edit: since I can't reply to response below (I think due to thread depth topping out). To clarify: they ONLY support SMS-based 2FA. No TOTP. Sure, other services offer SMS as well, but you wouldn't want to use that for securing any serious amounts of money (millions of dollars).
- cvccvroomvroom 4y agoLmao. That's some bikeshedding. Let me name other SMS 2FA "travesties" (regardless of TOTP support): Paypal, Box, Amazon, Citizen, Google, Zoom, Samsung, Signal, Lyft, (my bank), Coinbase, Discord, Ring, Twitter, ...
- NavinF 4y agoHe said “(ONLY!) use SMS-based 2FA”. Some of those sites support webauthn. TOTP is secure enough for the rest. SMS 2FA is only a problem when it’s the only option.
- throwaway290 4y agoWhy does offering an insecure authentication method stop being a problem when there are alternatives? It should not be offered.
- pc86 4y agoWhen you can't reply to a comment it's usually because it's brand new, to prevent flame wars. If you click on the "timestamp" (where it says "0 minutes ago") you'll be able to reply there regardless of comment age.
- fn-mote 4y agoYes, well unfortunately 2FA and banking and investing doesn't seem to go well together in the US. These companies move at a glacial place. Examples with huge market cap and no TOTP support (afaik): Vanguard ($6T+ managed), Chase Bank ($3T), and every botique investment firm I have dealt with. I personally don't count "we email you a secret code" as 2FA. Do other people?? I mean, sure my email might be secured with real 2FA, but it's just my gut reaction that this isn't nearly as good.