4 ms·
Any 2FA is better than no 2FA That's simply false because of the poor customer service of the providers and fates of many phones.
by protomyth 4y ago
Any 2FA is better than no 2FA
That's simply false because of the poor customer service of the providers and fates of many phones.
- Semaphor 4y agoHow is that false? Name a single example where SMS 2FA is worse than none. And just because it will always come up: 2FA, not treating the second factor as only factor.
- mellavora 4y agowhen your sim gets hijacked and someone steals your entire bitcoin wallet? worse than none because it "justifies" being sloppy with the first factor (i.e. account password).
- Semaphor 4y agoOkay, I guess if you stretch that hard you can reach your goal. edit: Your first sentence is meaningless because that is just as stolen with no 2FA.
- jjav 4y ago> Name a single example where SMS 2FA is worse than none. SMS is terrible because it is so easy to lose account access. Phone broken/stolen? Completely locked out. Or, I have this one financial institution that insists on sending SMS 2FA to the phone number on file, which is a 20+ year old landline which obviously can't receive SMS. Completely locked out. Someday I'll have to find out some way to get my money out of there (they have no local branches). I will always use TOTP if at all possible, because it's not a single point of failure. I store the seed values securely and they are backed up, so can't be lost.
- Semaphor 4y agoThat is actually a good point. Hadn’t thought of that. I hate TOTP, can handle SMS 2FA (sim-swapping is super rare here) and love FIDO/U2F/Webauthn (or whatever it’s called today). I have one with NFC on my keychain, and a backup device in the drawer. No off-site backup key, but encrypted backup codes.