4 ms·
Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-
by jcotton42 3y ago
Not only does GitHub not require SMS for 2FA, they discourage it https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-text-messages https://docs.github.com/en/authentication/securing-your-acco...
- bsder 3y agoA TOTP phone app is the same problem as SMS--my phone is the authenticator. It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something. And if my phone battery is dead, I can't log in. And if my phone is stolen, I'm screwed. None of these things improve MY security experience.
- russelg 3y agoThe main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.