4 ms·
But what is stopping them from offering both? You can have the SMS 2FA as the default option, but also offer TOTP for the technically minded.
by itsrajju 4y ago
But what is stopping them from offering both? You can have the SMS 2FA as the default option, but also offer TOTP for the technically minded.
- xienze 4y agoGenerally the justification is "hey, we offer one form of 2FA, that's pretty good. This TOTP thing is for paranoid nerds." Bosses see it as extra work for ~no gain, what's the point? You can explain the technical superiority of the approach until you're blue in the face but they see it as just another way to do what's already implemented.
- GoblinSlayer 4y agoThe technically minded can simply use a strong password.
- bvrmn 4y agoThis! There is no additional security for aware users with MFA. Make MFA turned on by default, ok, but for god's sake if you provide only SMS-based 2FA, allow it to be disabled.