3 ms·
Because it's not about 2FA. It will almost certainly be some shitty "We'll SMS your phone" thing in order to get your phone number. And this will enable attac
by bsder 3y ago
Because it's not about 2FA.
It will almost certainly be some shitty "We'll SMS your phone" thing in order to get your phone number.
And this will enable attacks from my phone that weren't there before.
Which actually makes me less secure.
It also means that Apple or Google can screw me on Github because they can lock me out of my phone.
- jcotton42 3y agoNot only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-text-messages https://docs.github.com/en/authentication/securing-your-acco...
- bsder 3y agoA TOTP phone app is the same problem as SMS--my phone is the authenticator. It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something. And if my phone battery is dead, I can't log in. And if my phone is stolen, I'm screwed. None of these things improve MY security experience.
- russelg 3y agoThe main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.