4 ms·
I agree that SMS is a terrible multi-factor. But it caught on because asking people to install an app is a massive ask. Not to mention, people never save those
by treflop 3y ago
I agree that SMS is a terrible multi-factor.
But it caught on because asking people to install an app is a massive ask. Not to mention, people never save those recovery codes.
Sure, you can use Authy and back up your codes but that’s pretty much squarely in the “for technical people” camp.
So at the end of the day, SMS is the only real solution for your average normal person. Let’s get cellular carriers to make SIM swapping harder.
- jay_kyburz 3y agoMy bank made me install Symantec VIP. Yuck. To do my tax I need MyGovID. Also Yuck.
- zadokshi 3y agoHow did the bank “make” you do this? Does your country only have one bank?
- jay_kyburz 3y agoAs much as I hate the apps, I'm not prepared to refinance my house just to avoid installing them on my phone. Especially when the other banks probably have the same policies, or will soon.
- autarch 3y agoThe Symantec app is just a regular TOTP app but a bit more annoying. You can usually replace it. See https://locima.com/2019/06/01/replacing-symantec-vip-with-a-generic-totp-app/ https://locima.com/2019/06/01/replacing-symantec-vip-with-a-... for one method. I did this to get my Etrade account TOTP from Symantec into Authy.
- deleted 3y ago[deleted]
- pests 3y agoGoogle Authenticator now syncs to your google account.
- Mistletoe 3y agoI’m not even sure this is a positive thing.
- fattire 3y agoYou can opt out of it thankfully.
- davchana 3y agoI have always saved my dtrings in a separate keypass database. New Google Auth takes a second or 5 to show accounts. I use old apk because that one shows accounts in a millisecond.
- jameshart 3y agoiOS’s inbuilt password manager supports TOTP second factor authentication right in the operating system, no app needed.
- iknowstuff 3y agoYeah but no normie knows about it. It never prompts to store them.
- __MatrixMan__ 3y agoIsn't the point of a second factor that it's... Not the same as the first factor? My TOTP app password is one of the few that don't go into the password manager. Might as well make 'em compromise each separately.
- vel0city 3y agoEh. It still makes the credentials rotating credentials instead of permanent credentials. If your username + password + single TOTP value gets stolen, they won't be able to re-auth once that credential gets invalidated. So say a site accidentally logs auth attempts, and someone finds the log. Sure, they know your username + password now, but they don't know a good current TOTP value. And TOTP values are supposed to be one-time-use, so even if they catch it quick it'll be invalid very fast. Its better than not having TOTP, but not quite as secure as it could be. Theoretically its still something you know and something you have in that its something you "know", the static password, and something you "have", the rolling TOTP generator.
- __MatrixMan__ 3y agoIf the password manager was compromised (not accessed without permission, but updated without permission) then it wouldn't be just the single TOTP value that leaked, it would be the underlying key. On a mobile device you might be a bit limited in how "distant" you can keep the two, since the vendor is typically almighty in that scenario. But in general, you have options and you might as well avoid keeping both eggs in the same basket.
- lxgr 3y agoIt worked for every single card-issuing bank in Europe. SMS are fortunately both expensive enough there to make them uneconomical for banks to use them as an OTP factor, and have been found too insecure for payment authentication by themselves, requiring a second factor. This has practically lead to banks offering something more secure and/or ergonomic, e.g. bank-specific authenticator apps (which often work without internet, and always work without cell signal, e.g. when traveling internationally), hardware authenticators, WebAuthN etc. > Let’s get cellular carriers to make SIM swapping harder. No, let's get financial companies to step up their game and offer something not liable to both security breaches and locking out users (when traveling, losing access to their number etc.)
- daveoc64 3y agoMany banks and card issuers are using SMS for 2FA in Europe.
- lxgr 3y agoNo bank is using (only) SMS as an authentication factor for 2FA. It's not allowed under the EBA's technical interpretation of the PSD2 regulation. Some banks do still allow it as a fallback option, together with another factor, e.g. a password or other knowledge factor. My bank even made it a paid service, which I fully support – SMS is extremely overpriced.
- daveoc64 3y agoI'm in the UK, so our implementation of the PSD2 regulation may be a bit different (in came in while the UK was leaving the EU), but I get SMS 2FA codes from American Express all the time in the 3D Secure process.
- lxgr 3y agoSome banks do still allow SMS by itself as the only authentication factor (presumably because they haven't got around to updating their solution or maybe think they've found a workaround), but it's not compliant with the PSD2 regulation in the EU at least. The solutions I've seen usually use a password or security question as the other factor.