4 ms·

What do you do when your phone fails? 2fa can also be soft-defeated by simply using iMessage or messages.google.com, so sms codes go to the desktop machine you

What do you do when your phone fails? 2fa can also be soft-defeated by simply using iMessage or messages.google.com, so sms codes go to the desktop machine you're trying to log in from. Does that mean we should eliminate services that connect to phone messaging?

blibble 4y ago
> What do you do when your phone fails? backup codes, a second enrolled device (maybe an old phone), a copy of the key stored offline many different ways > 2fa can also be soft-defeated by simply using iMessage or messages.google.com, so sms codes go to the desktop machine you're trying to log in from. yes, a certain crappy type of "2fa" can be defeated if you choose to upload all your SMSes to a website in realtime good luck getting my TOTP or U2F keys that way
- alanbernstein 4y ago
  I'm asking out of practical curiosity, what do you actually use for that? Google authenticator only works on one device, which is a single point of failure. Authy allows multiple devices, which enables both backups and the defeat you described. What are some other ways? Crappy sms 2FA is, in my experience, completely unavoidable, because many critical services have that as the only option.
  - blibble 4y ago
    > I'm asking out of practical curiosity, what do you actually use for that? I have used all three I gave you in my previous comment (all my critical services now all use U2F though, which is vastly superior) > Google authenticator only works on one device you can scan the qr code on more than one device you can also print the qr code out (or write the key down) you can also export the entire list to another device inside google authenticator no need for online storage of anything
    - alanbernstein 4y ago
      > (all my critical services now all use U2F though, which is vastly superior) That's cool, I don't know of a single service I use personally that supports it.
      - blibble 4y ago
        > That's cool, I don't know of a single service I use personally that supports it. you previously mentioned imessage and messages.google.com, both of which support it

blibble 4y ago

> What do you do when your phone fails? backup codes, a second enrolled device (maybe an old phone), a copy of the key stored offline many different ways > 2fa can also be soft-defeated by simply using iMessage or messages.google.com, so sms codes go to the desktop machine you're trying to log in from. yes, a certain crappy type of "2fa" can be defeated if you choose to upload all your SMSes to a website in realtime good luck getting my TOTP or U2F keys that way

alanbernstein 4y ago
I'm asking out of practical curiosity, what do you actually use for that? Google authenticator only works on one device, which is a single point of failure. Authy allows multiple devices, which enables both backups and the defeat you described. What are some other ways? Crappy sms 2FA is, in my experience, completely unavoidable, because many critical services have that as the only option.
- blibble 4y ago
  > I'm asking out of practical curiosity, what do you actually use for that? I have used all three I gave you in my previous comment (all my critical services now all use U2F though, which is vastly superior) > Google authenticator only works on one device you can scan the qr code on more than one device you can also print the qr code out (or write the key down) you can also export the entire list to another device inside google authenticator no need for online storage of anything
  - alanbernstein 4y ago
    > (all my critical services now all use U2F though, which is vastly superior) That's cool, I don't know of a single service I use personally that supports it.
    - blibble 4y ago
      > That's cool, I don't know of a single service I use personally that supports it. you previously mentioned imessage and messages.google.com, both of which support it