4 ms·
The issue is that some services insist on using their own app as a second factor. You can't choose to use a superior U2F YubiKey, for example. You are also not
by vladvasiliu 4y ago
The issue is that some services insist on using their own app as a second factor. You can't choose to use a superior U2F YubiKey, for example. You are also not allowed to have their shitty app installed on multiple phones at the same time. If you lose your phone, you need to call them up to reset this.
To name and shame: BNP Paribas, one of the biggest banks in France.
- Double_a_92 4y ago> you need to call them up to reset this My bank sent me a super key (some colorful QR code) to setup new 2FA devices, which I need to securely store somewhere.
- cube00 4y agoIt's interesting that a super key even exists. Normally the enrolment QR codes are one time use only.
- gunapologist99 4y agoThis is incorrect. A standard TOTP QR code can be used on multiple devices or saved and printed (and stored in a safe or something). There is no expiration date encoded in the QR; it is simply the shared secret for the TOTP app to use and some extra metadata like labels. See https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238 It is a good idea to enroll multiple devices as a backup against failure, or to store it somewhere safe.