4 ms·

Half the time, even if a service supports autheticator app 2FA and not just sms, all it takes is just clicking “use another method” on the 2FA page, and it defa

Half the time, even if a service supports autheticator app 2FA and not just sms, all it takes is just clicking “use another method” on the 2FA page, and it defaults to sms-based 2FA anyway. And it would still require a phone number when registering, so there is no way to avoid that fallback anyway. Borderline useless.

jandrese 3y ago
The services require a phone number not because it adds security, but because it is a monetary challenge for scammers. If a service allows for multiple 2FA types it usually demands SMS for the initial setup, but once that is done you can remove your phone number to force it to switch to TOTP or a token. It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service.
- filoleg 3y ago
  That’s totally fine, i am not against services requiring phone numbers during registration. I am just against those services allowing sms to be used as an easy 2FA fallback when an app-based 2FA is enabled. Because doing so makes app-based 2FA kinda useless. I agree with your points, it just feels insanely rate to see a service utilizing phone number requirement for registration the proper way (i.e., the way you describe).
  - bsder 3y ago
    > That’s totally fine, i am not against services requiring phone numbers during registration. I am completely opposed to services having any PII (Personal Identifiable Information) beyond an email address because the dumbass services keep my PII and then lose it when they get hacked. If I can go collect a million dollars from a company that loses my PII, I'd let them collect it. SInce I can't, my best option is to refuse. If you want to verify, take a credit card number. At least I can cancel and change that when some dumbass get hacked and loses it.
- Wowfunhappy 3y ago
  > It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service. Are you relatively confident that these sites actually delete removed phone numbers?
  - jandrese 3y ago
    All I'm confident about is that they certainly won't delete them if you leave it as a 2FA option.

jandrese 3y ago

The services require a phone number not because it adds security, but because it is a monetary challenge for scammers. If a service allows for multiple 2FA types it usually demands SMS for the initial setup, but once that is done you can remove your phone number to force it to switch to TOTP or a token. It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service.

filoleg 3y ago
That’s totally fine, i am not against services requiring phone numbers during registration. I am just against those services allowing sms to be used as an easy 2FA fallback when an app-based 2FA is enabled. Because doing so makes app-based 2FA kinda useless. I agree with your points, it just feels insanely rate to see a service utilizing phone number requirement for registration the proper way (i.e., the way you describe).
- bsder 3y ago
  > That’s totally fine, i am not against services requiring phone numbers during registration. I am completely opposed to services having any PII (Personal Identifiable Information) beyond an email address because the dumbass services keep my PII and then lose it when they get hacked. If I can go collect a million dollars from a company that loses my PII, I'd let them collect it. SInce I can't, my best option is to refuse. If you want to verify, take a credit card number. At least I can cancel and change that when some dumbass get hacked and loses it.
Wowfunhappy 3y ago
> It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service. Are you relatively confident that these sites actually delete removed phone numbers?
- jandrese 3y ago
  All I'm confident about is that they certainly won't delete them if you leave it as a 2FA option.