5 ms·
Agree, non-TOPT MFA is a scourge. It's criminal that Google requires you to set up a phone-based or proprietary MFA before you can switch to TOPT. Your phone
by zdw 3y ago
Agree, non-TOPT MFA is a scourge.
It's criminal that Google requires you to set up a phone-based or proprietary MFA before you can switch to TOPT.
Your phone number isn't something you "have" - it's something you're renting from another big company, and their security has obvious reset holes made to cope with unsophisticated users, therefore is worse than a password managers.
The only workaround I've found that is non-distracting is to have a dedicated phone-to-web/email system... Google Voice works for this if you're US based.
- eternityforest 3y agoI greatly prefer SMS auth(At least for personal stuff, I see the value of TOTP for work) because of exactly those reset holes. For low value targets it's not really much of an issue, and makes it much harder to get locked out of your account, which would be almost as much of a problem as getting hacked.