3 ms·

A question here is 2FA with e-mail considered better or worse than SMS?

• mindslight 4y ago
  It's not "better" or "worse", but rather should be up to the user. I've got a bank where them sending the SMS just silently fails, probably because my phone number is on GVoice. The web forms will allow me to do email challenge, but then calling customer service I've got to tell them about the hidden option in their own system to turn it into a voice call challenge rather than the broken SMS. I myself generally prefer email, because the message comes in quicker going directly to my SMTP server rather than bouncing through GVoice and then to my SMTP server. But if the formatting of the email doesn't make the nonce readily visible and selectable, then I'll prefer SMS because the limited length forces them to leave off most fluff. But really, all of this should be consensual at the behest of the user, not forced by the bank to push liability onto the user. The main security model of US consumer banking is to report unauthorized transactions within 60 days and they'll be reversed. So anything that hinders me checking my accounts every month is a negative for my own security. My preferred system would be straight password for a full-access login (to be stored by my password manager), and then a separate password for read-only login with a well-documented API (to be used by automated scripts).