3 ms·

I wish there was some credible government authority to clearly tell services they cannot offer SMS only 2FA, they cannot limit to “mobile phones only” (ie no Go

I wish there was some credible government authority to clearly tell services they cannot offer SMS only 2FA, they cannot limit to “mobile phones only” (ie no Google voice), and they can’t restrict TOTP to one off proprietary tools like Authy. “Person is within USA with mobile phone plan” is hardly an authentication scheme.

grecy 4y ago
I just ran into this. My bank used to send codes over email, but for some reason a couple of months ago they decided SMS was the only option. I said "So you're forcing people to have a phone with a plan?" "Yes."
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
rekoil 4y ago
And also that they must offer users the possibility of disabling SMS-based authentication if another scheme is enabled. On Microsoft 365, if you setup "forced MFA" on your organisation, then they additionally force users to add a phone number which can be used for account recovery. I get why Microsoft wants to keep account recovery possible in this manner, but I am not someone who needs it, and there needs to be a way for me to make my account more secure where my phone company can't take over my account...
- zenexer 4y ago
  You can actually stop the MFA onboarding process when it asks for your phone number—just close the tab or window. You’ll still get TOTP or whatever else you already configured. It makes it sound as though you also need to add a phone number, but you don’t.
pabs3 4y ago
How does the TOTP secret get copied into Authy? Seems like you could just copy the data out of that and into an open source tool instead of Authy.
- anonomousename 4y ago
  The TOTP URIs can be exported - I use this to export them into Bitwarden: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
numpad0 4y ago
Phone companies should have banned SMS 2FA as an abusive use, or at least charged extra for senders. What it does is offloading KYC to mobile phone subscriber databases.
- lotsofpulp 4y ago
  It is in all the parties’ best interest (too big to fail business, mobile network, and the government). No accountability, low cost, and the ability to finger point.

grecy 4y ago

I just ran into this. My bank used to send codes over email, but for some reason a couple of months ago they decided SMS was the only option. I said "So you're forcing people to have a phone with a plan?" "Yes."

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]

rekoil 4y ago

And also that they must offer users the possibility of disabling SMS-based authentication if another scheme is enabled. On Microsoft 365, if you setup "forced MFA" on your organisation, then they additionally force users to add a phone number which can be used for account recovery. I get why Microsoft wants to keep account recovery possible in this manner, but I am not someone who needs it, and there needs to be a way for me to make my account more secure where my phone company can't take over my account...

zenexer 4y ago
You can actually stop the MFA onboarding process when it asks for your phone number—just close the tab or window. You’ll still get TOTP or whatever else you already configured. It makes it sound as though you also need to add a phone number, but you don’t.

pabs3 4y ago

How does the TOTP secret get copied into Authy? Seems like you could just copy the data out of that and into an open source tool instead of Authy.

anonomousename 4y ago
The TOTP URIs can be exported - I use this to export them into Bitwarden: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

numpad0 4y ago

Phone companies should have banned SMS 2FA as an abusive use, or at least charged extra for senders. What it does is offloading KYC to mobile phone subscriber databases.

lotsofpulp 4y ago
It is in all the parties’ best interest (too big to fail business, mobile network, and the government). No accountability, low cost, and the ability to finger point.