3 ms·
Yet, most banks in the US force the use of SMS 2FA without offering TOTP as an option. Truly incompetent institutions we've created.
by hypeatei 3y ago
Yet, most banks in the US force the use of SMS 2FA without offering TOTP as an option. Truly incompetent institutions we've created.
- dheera 3y agoYet other institutions do single TOTP with SMS backup instead of TOTP with a 2nd TOTP backup. The former is as bad as SMS.
- klabb3 3y agoI think the popularity of phone numbers is not because it’s a good auth factor but because it is a little more work to Sybil flood with generated identities, compared to say email. So it’s not for our security exactly, but more for the company’s anti-abuse systems, and maybe the marketing department that loves hoarding phone numbers. That it works as a second factor is just a “happy” coincidence. Which in turn annoys me to no end given that phone numbers are regional. Having no access to banks when moving, let alone traveling, to an area with no cell service or a different country, is infuriating. It’s like “what’s your mother’s maiden name” all over again.
- fuster 3y agoMy bank took away the ability to do 2FA via email and is phone-only now. At least with the typical Gmail/equivalent account you have the option of making that less vulnerable to social engineering and outright bribes.
- dvzk 3y agoSMS 2FA is one thing. Bad, but ineffective. SMS-based account recovery is far worse. Every time a major website asks me for a phone number "in case you lose access to your email account" I freak out internally before ensuring I never enter it.
- causal 3y agoRight. The SMS 2FA risk is overstated IMO - at worst it makes it as insecure as password-only, and at best it creates a roadblock for attackers that can be significant for locked SIMs. But SMS account recovery is definitely opening the door to attack.
- deleted 3y ago[deleted]
- h4xZsys 3y ago[dead]