3 ms·
In the past two years or so I’ve seen the floodgates open for un-opted-in email-based 2FA, usually tied with “known device” recognition. This is obviously more
by semiquaver 3y ago
In the past two years or so I’ve seen the floodgates open for un-opted-in email-based 2FA, usually tied with “known device” recognition. This is obviously more secure than SMS but I just wish it weren’t less convenient, especially on mobile (specifically talking about the iOS 2FA iMessage input method integration)
By contrast I feel like SMS 2FA increasingly is not an option, or at least not the default.
Almost no sites I interact with outside of big tech offer TOTP or FIDO2, which is a real shame.
- njovin 3y agoI don't see how email-based 2FA is more secure than SMS. With email, if an attacker gains access to my email account she can remotely de-auth my mobile device's email client, reset my password for service X, and sign in to service X without my knowledge (assuming I don't notice my email client has stopped working). With SMS, if they gain access to my email account, I at least get the notice of the attempted login via SMS and can take appropriate action.
- semiquaver 3y agoSMS is architecturally insecure. It’s been demonstrated time and time again that cellular providers cannot effectively prevent SIM-hijacking via social engineering and other means. Email isn’t perfect, but I believe that my account is much more resistant to takeover than my phone number is.
- robertoandred 3y agomacOS/iOS support autofilling 2FA codes received via email in addition to those received via Messages.
- semiquaver 3y agoYeah, but only if you use Mail.app. AFAIK there’s no api for third party apps like gmail to do so.
- vundercind 3y agoYou can always add the account there and then never open it, just to get the 2fa filling. I prefer it anyway since I have multiple accounts and they’re not all gmail.
- semiquaver 3y agoNot a bad idea, thanks!