7 ms·
Before this new wave of SMS trash, we just had TOTP codes that 1password could auto fill for me on any device in any location. Now i need to pull out my phone c
by zaptheimpaler 3y ago
Before this new wave of SMS trash, we just had TOTP codes that 1password could auto fill for me on any device in any location. Now i need to pull out my phone constantly and pay for international roaming or setup SMS forwarding to travel even if I don't need the number. Yay security!
If the argument is that phone number can always be recovered from real world identity, link the damn authenticator app to SMS instead of having to hand out your phone number to every company in the world.
- Groxx 3y agoThe problem is that your authenticator app doesn't give them access to a relatively stable, cross-site/app/etc identifier that they can sell for advertising peanuts.
- JumpCrisscross 3y agoRequire a phone number for account creation and support TOTP. Win-win.
- lcnPylGDnU4H9OF 3y agoIt’s a loss from the business’ perspective. They could support 2FA with SMS and check a box; to additionally support it with TOTP would only be additional cost -- albeit with the bonus of “doing it right”. Unfortunately, that’s an abstraction which a lot of businesses consider to be achieved when they can check the box.
- nikau 3y agoAlso average Muppet consumer can't manage it
- bugbuddy 3y agoNot true. If we make Yubi keys cheap enough (below $5) then everyone would want them. Everyone is already carrying around keys, they won’t mind 1 more key. Why can’t we make yubi keys cheaper?
- hedora 3y agoPocket space is finite. There's no way I'm carrying a yubikey unless I can jam it in my laptop USB port (defeating the purpose of it) and forget about it.
- bootlooped 3y agoThat wouldn't defeat the purpose of it.
- scrose 3y agoA Yubikey used in that way is still more efficient and secure than every other option. Someone would need to physically take your laptop, unlock it, and get your account passwords before they could use your yubikey to login to accounts.
- bofaGuy 3y agoThen why not just store the encrypted credential on the device itself? Would that be what passkeys would be?
- crote 3y agoTheft: A $2000 laptop is an easy target for anyone with sticky fingers, and so is a $1000 smartphone. A Yubikey has essentially zero resale value, so you will not lose them due to random theft. Durability: If you drop your smartphone, there's a pretty good chance you'll shatter the screen and buy a new one. You can play tennis with a Yubikey and it'll be fine. You can run it through the washing machine and it'll be fine. Longevity: Laptops and smartphones generally only have a 3-5 year lifespan due to battery degradation, and many people will want to swap it for one with more storage or whatever anyways. A Yubikey will essentially last forever, and if you stay clear of the insanity that is Passkeys its Webauthn element can support an infinite number of websites. Portability: I have a smartphone, a work laptop, a home laptop, and a home desktop. My Yubikey has USB and NFC, so it can trivially be used with all of them. Individually enrolling each device would be a nightmare, and having the credentials sync is a bad idea from a security perspective. Security: If your device gets compromised, it's pretty much game over: the attacker can now log in to all your accounts, any time they want. With a Yubikey I have to physically insert it and tap the button for each login - which is relatively rare because active sessions don't tend to expire. This means I would have to actively participate in a mass compromise of my accounts, making it way more likely to be noticed.
- fastball 3y agoAlso an identifier that is much harder to create bots/spam with, as phone numbers are harder to come by than email addresses.
- deleted 3y ago[deleted]
- Frost1x 3y agoAlmost counterintuitively I deal with more spam SMS than I do email but that’s probably less a factor of actual volume and more a factor of the need and sophistication of filters for both services.
- masklinn 3y agoIt’s likely also a function of the market / location / network incentives. May own anecdote is that I almost never receive spam sms despite having nothing in place beyond whatever my service provider does. Spam mails make it through two+ layers of filters (service provider + my own) more often than I get spam SMS, and I have to trawl the wasteland that is the spam box once in a while to ensure important mails have not been missclassified.
- nicbou 3y agoThat's why my banks use their own apps as 2FA factors.
- lifestyleguru 3y agoThe own 2FA apps of my banks inevitably stop working at some point. They shut down immediately after launching them. Alternatively they stop reacting on tapping the "confirm" button. If I leave them unattended for few months, I'm almost certain they'll not work on next use.
- fmobus 3y agoI've added a recurring event on my calendar to check login-ability to several apps with which I've had this kind of experience in the past. At least once per month.
- rgbrenner 3y agoBefore this new wave of SMS trash, we just had TOTP codes SMS 2FA predates cell phones. First SMS 2FA was AT&T in 1996 using pagers. The first draft of the RFC for TOTP was written in 2008. Google Authenticator came out in 2010.
- minitech 3y agoAnd TOTP predates “this new wave of SMS trash”, when every service actually started using it.
- deleted 3y ago[deleted]
- burnerthrow008 3y agoEh, that’s a bit pedantic. I knew someone who worked for a bank in the late 80’s - early 90’s, and I distinctly remember them having a little keychain dongle that generated one-time codes every (30? 60?) seconds for secure remote login. The product may have been an RSA SecurID, or something else. Branding aside, it’s the same concept as modern TOTP. The main novelty of the TOTP RFC was standardizing the setup / secret sharing process and algo.
- gruez 3y ago>Now i need to pull out my phone constantly and pay for international roaming Weird, all the carriers I used either have free international roaming (at least for receiving text), or have wifi calling which allows me to use my phone as if I'm on the home network anywhere with an internet connection.
- lxgr 3y agoMine doesn't! And though the one I used before did, I usually have a cheaper local SIM in my phone for data use when I'm traveling, and I'm not swapping SIMs just to authenticate to some company that hates its customers.
- ensignavenger 3y agoI am occasionally out of the country for more than a month... I usually pause my phone plan because I don't want to pay for a service I am not using. Sometimes I even get a different number when I return and restart my plan. That is why I use Google Voice, because I can use it over wifi or a data only plan, and the number doesn't change. But now, some stupid companies are blocking Google Voice from being used.
- jeromegv 3y agoThank you for your anecdote. However your personal experience doesn't reflect everyone. Many people don't have free international roaming, in fact mine only has roaming for US (I'm in Canada) and for zero roaming options available outside of North America.
- Symbiote 3y agoOutside North America, receiving text messages is always free. Receiving calls isn't necessarily free when roaming.
- daveoc64 3y agoAs a European, the idea of paying to receive a call or text is alien to me, but I understand it happens in the USA. I'm pretty sure it's illegal for an EU network to charge for receiving a standard SMS or MMS - even while roaming. I can therefore receive an SMS OTP in any country and won't pay a penny.
- ensignavenger 3y agoI use my Google Voice number for everything because I can't trust I will have the same number if I change carriers (I have found the porting numbers between MVNOs can be hit and miss) and because I sometimes travel internationaly. Now, stupid companies are demanding a phone number, and blocking Google Voice from being used...
- kurthr 3y agoDon't worry, soon Google Voice will be abandoned by tehGoog. (Perhaps this is just dread since I use it for the same purpose)
- ensignavenger 3y agoI understand the feeling! I would love to find an alternative, but I haven't yet. I only use Google Voice for services that demand it, and I try to find alternative services when possible. I never use SMS auth for anything truly critical.
- AnonC 3y agoGoogle Voice (the free service) has its own pitfalls, which I believe make it a very poor choice to use for online accounts. I’m speaking from personal experience. If you happen to not use it for a little while, Google Voice will send an email with minimal notice (with Murphy’s Law, this will be during a vacation break) that the number will be deactivated. Once that happens, you cannot reclaim that Google Voice number using the same linked phone number. You have to get a new phone number that has never ever been used with Google Voice and then try to link it. Even then, Google Voice will send the OTP and make it seem as if the linking worked but will show as unlinked (and the Google Voice number unavailable) after just a minute or two. You’ll have to retry with another number over and over again until you start banging your head against the wall. After maybe a few weeks or several weeks, that Google Voice number will not even show up for reclamation. Google Voice is a total mess, and as a “free” consumer service that Google has shown little interest in maintaining and supporting, you don’t get any kind of support or help whatsoever. My sincere advice (if you’re a free Voice user) would be to delink your Google Voice number from all critical services. Get a real phone number for which you have the ability to get customer support.
- 2Gkashmiri 3y agoIn India your Sim card stops working if you do not recharge ebery month and after 2nd month, the number gets blocked, after 90 days the number gets canceled and recycled. The going argument is, WhatsApp if your number gets unused for 90 days doesn't let you reset password or something so its all fine. Then its a matter of submitting a written application with the bank to change your mobile number so its all fine
- davchana 3y agoI recharge my airtel with Rs 1700 something, which gives me a 365 days validity, without need of any additional recharge (plus some GB data everyday).
- 2Gkashmiri 3y agothat is.......... a lot to spend in one go
- lakpan 3y agoA few countries in the area have such a short length unfortunately. I’m lucky to have my European SIM card that I can top up once every 12 months. And even if they deactivate it after 13 months, I can recover it within the successive 12 months if I remember correctly.
- rlt 3y ago> we just had TOTP codes that 1password could auto fill for me on any device in any location Doesn’t using your password manager as TOTP code generator reduce the number of factors back to 1?
- WWLink 3y agoYou could always use a different password manager or different buckets. Both the apps I use (one for TOTP and one for passwords) can do both lol.
- artimaeis 3y agoIf the attacker is targeting your 1P, then yes. If the attacker got a list of passwords from a leak and your password was on it, the 2nd factor provided by the TOTP will still save you. So, it just depends on your threat vectors. I’d rather people I support keep unique passwords alongside TOTP in a manager they’ll actually use than skip or use SMS TOTP because of a vague concern about targeted hacking of their manager.
- lolinder 3y agoIf you're already using a password manager with secure randomized passwords, you're not vulnerable to credential stuffing unless that specific service had a breach. I suppose TOTP may still protect against unsophisticated phishing, but only as long as the attacker doesn't phish a TOTP code at the same time and pass it straight along to the service. Are there other threats that TOTP-in-password-manager can protect against that the randomized passwords don't already?
- Groxx 3y ago>Are there other threats that TOTP-in-password-manager can protect against that the randomized passwords don't already? tbh the UX problem of 2fa for "I use random passwords and am not vulnerable to credential stuffing" users is a pretty big reason to stick TOTPs in your password manager. Security is always a series of trade-offs, and 2fa brings some hideous trade-offs in many sites (well over half only allow one at a time, for example, and then you lose access permanently). TOTP with a standard like this lets you choose, rather than the site choosing for you.
- davchana 3y agoInuse a simple APK which makes http post request on very incoming SMS. That post request is processed by my own Google apps Script to send it to my own telegram bot. When I travel where my phone will not work in that country, my wifi connected devices get OTP right away, in about 5 seconds.
- WWLink 3y ago> Before this new wave of SMS trash My favorite is it's often paired with "passwordless" trash lol. Why can't I just give my whole fucking credential out in 1 action. What's this nonsense where I have to enter my username, THEN wait for the page to load, THEN click "send verification email" or "send code", then half the time they want to SMS me and have me enter another code lmao.
- iacvlvs 3y agoI use 1password with Fastmail integration to create unique email addresses for each login. This new “sipping from thimbles” approach to authentication breaks that because iOS and/or 1pass don’t recognise it as a login until the password screen, so I’m swapping and searching and copying and pasting just to log in. I viscerally hate that sort of user hostile design of the auth/login.
- EVa5I7bHFq9mnYK 3y agoAnd don't forget to solve 10-stage captcha before eveey page load!
- WWLink 3y agoMy favorite is when you try to sign in, but it fails because you didn't answer the captcha on the login screen... because the captcha never loaded.
- burnerthrow008 3y ago> What's this nonsense where I have to enter my username, THEN wait for the page to load, THEN click "send verification email" I can’t speak to all of them, but many sites that require (only) a username first have enterprise SSO integrations. The enterprise buying the service (understandably) doesn’t want its employees to type in both username and password on a 3rd party site, especially since the SSO process will handle auth after the username is entered. I know of one site with both username and password on the first page, and has enterprise SSO. Login will automatically fail if you enter anything in the password field when logging in with an SSO-enabled username. But that doesn’t stop copy-pasted credentials from being transmitted to their server, which is something enterprise customers want to avoid
- eru 3y agoI agree with most of what you say, however: > [...] pay for international roaming [...] I don't remember ever having to pay to receive SMS abroad. Is that a common feature with the plans where you live? (I mostly have experience with pre-paid plans from Asia, Australia and Europe.)
- reedciccio 3y agoAmericans screwed up mobile phones since the beginning: they pay on both ends, to receive and to make calls and sms.
- ummonk 3y agoI just want an authentication / identity service that lets me select the recovery difficulty (anything from showing my government issued ID or fingerprint verification to actual rapid DNA testing, all for an appropriate fee), along with specifying account beneficiaries in the event of death / incapacitation. It’s absurd that for ultimate identity, currently services tend to rely on email, google account, or SMS, all of which are some combination of insecure, at risk of banning you on a whim, hard to recover, or prone to spam since they don’t verify real life identity.