4 ms·
> Google has, I think, 3? There's at least: 1. SMS 2. TOTP 3. Google Prompt (on Android / iOS) 4. Offline security codes (distinct thing from TOTP, generat
by jsnell 4y ago
> Google has, I think, 3?
There's at least:
1. SMS
2. TOTP
3. Google Prompt (on Android / iOS)
4. Offline security codes (distinct thing from TOTP, generated from Android settings)
5. Backup codes
6. Security Key
- magicalhippo 4y agoDo you have some documentation for this? All I could find[1] pointed to them only supporting OAuth, similar to Microsoft. [1]: https://developers.google.com/gmail/imap/imap-smtp https://developers.google.com/gmail/imap/imap-smtp
- jsnell 4y agoI didn't mean that they had native IMAP support for those, but that these are the 2FA methods they support in general. With browser-based OAuth, it's viable to build support for a new 2FA method in just one place. Needing to build each of these into a protocol + get all popular IMAP clients to implement that support? It'd take an eternity; we'd probably still be stuck on just TOTP.
- magicalhippo 4y agoAh yes, my misunderstanding. Indeed, OAuth makes it easy to swap out the actual authentication step. Which is nice, because the service shouldn't really care about that, only that the user is authenticated and authorized.
- 0x457 4y agoThe security Key could also be a Bluetooth-enabled security key or pixel phone.