3 ms·

I disagree here, suspicion is not warranted - I'd prefer that they support additional non-sms 2FA paths, but supporting SMS based 2FA has many benefits for a co

by olliej 4y ago

I disagree here, suspicion is not warranted - I'd prefer that they support additional non-sms 2FA paths, but supporting SMS based 2FA has many benefits for a company beyond being "lazy" SMS is vastly better than nothing, and it has the benefit of not requiring users install random software that they (a) don't know how to install, (b) don't know how to use, (c) don't have a recent enough device to use, (d) you don't need to worry about them deleting the app and then losing their 2f, (e) doesn't require your customers having an account with (and potentially paying) another company just to log in to your site, etc I really do think that tech people over estimate the proportion of people for whom at least one of the above applies. Not everyone runs a one or two year old phone, many of the very cheap phones run very old versions of android, can't be updated, etc Obviously SMS 2FA has a different problem as the sufficiently poor may not have a constant phone number, obviously sim hijacks can happen but the targeting requires much more effort than simply moving on to the next non-2fa account. [edit: updated to make sentence structure not look like a series of wordle guesses]

nl 4y ago
TOTP should run on any smartphone, including phones that are much older than 2 years.
- olliej 4y ago
  Huh, you're correct those apps have much longer support than I expected - but did not check :( - from free apps (though I guess Google Authenticator is backed a small immigrant business :D ), thanks for pointing out my error, I'd fix my comment but can no longer edit things. What I was trying to say there are a _lot_ of very old smart phones in poor communities, and they're still in use. I searched craigslist in very poor parts of the US and I can find quite a few phones that are running android <= 4, and have fingerprints implying they were in use. I would guess that that end of the spectrum has many more offline only transactions. It's also a community who may not have internet access, and may not have library access, which is how people in larger cities can access the internet (from volunteering I discovered sometimes to watch porn :-/). Not intended as a correction to your comment, but just as a backup for my statement that plenty of phones still can't use TOTP apps, the cheapest phones with t-mobile are not smartphones, and the cheapest ones on amazon are not running a recent enough android, and some even run Windows OS?!?!?!

by olliej 4y ago

nl 4y ago

TOTP should run on any smartphone, including phones that are much older than 2 years.

olliej 4y ago
Huh, you're correct those apps have much longer support than I expected - but did not check :( - from free apps (though I guess Google Authenticator is backed a small immigrant business :D ), thanks for pointing out my error, I'd fix my comment but can no longer edit things. What I was trying to say there are a _lot_ of very old smart phones in poor communities, and they're still in use. I searched craigslist in very poor parts of the US and I can find quite a few phones that are running android <= 4, and have fingerprints implying they were in use. I would guess that that end of the spectrum has many more offline only transactions. It's also a community who may not have internet access, and may not have library access, which is how people in larger cities can access the internet (from volunteering I discovered sometimes to watch porn :-/). Not intended as a correction to your comment, but just as a backup for my statement that plenty of phones still can't use TOTP apps, the cheapest phones with t-mobile are not smartphones, and the cheapest ones on amazon are not running a recent enough android, and some even run Windows OS?!?!?!