4 ms·
SMS-based 2FA is still vulnerable to phishing, but U2F is not. This has been solved for a while now, but I guess it's still a hassle for most folks to use them
by wffurr 3y ago
SMS-based 2FA is still vulnerable to phishing, but U2F is not. This has been solved for a while now, but I guess it's still a hassle for most folks to use them.
I got my whole family Yubikeys a while back, and it seems to be going pretty well.
- cogman10 3y agoHow do you backup access? The one thing that's stopped me from pulling the trigger on U2F is if that device is lost, stolen, or broken then I'm hosed, right? With standard 2FA, I have backup devices and codes that I can start restart from scratch if my phone is ever lost/stolen/broken.
- wffurr 3y agoWrite down your backup codes. Register a second key if possible. Google accounts are set up to prompt phones, too. In some cases we still have SMS 2FA enabled.
- happyopossum 3y agoBackup codes and (in my case) backup keys. In the corporate world, the backup codes can be generated and shared on-demand, or U2F temporarily disabled if ID can be verified another way.