4 ms·
I would not want to trust my bank account to all of the following: * the people that run the Signal Servers (or whoever). * The people that send the verificat
by upofadown 4y ago
I would not want to trust my bank account to all of the following:
* the people that run the Signal Servers (or whoever).
* The people that send the verification SMS.
* The phone company.
... even for a little while.
Two factor only verifies you, not the bank.
- lotsofpulp 4y agoDoes TOTP 2FA solve not having to trust those other entities?
- bombolo 4y agoMany force you to install their own app instead of using a generic one. Which is a problem. Also google's app doesn't easily let you export and backup the seeds. So you either remember to do that initially or breaking your phone == losing access to everything.
- account42 4y ago> Many force you to install their own app instead of using a generic one. Which is a problem. I agree that having to use a proprietary app is not great, but TOTP is vulnerable to MITM attacks because the tokens are not restricted to a specific action but only to a time slice. For many use cases that is not a big problem, but for a bank account I'd want more security. Of course being able to do your banking in the same app or a slightly different one on the same device kind of defeats the purpose.