3 ms·
Google Authenticator makes it very unclear to average users how you back up or transfer stuff to other devices. Sites that support Google Auth are gonna have to
by hot_gril 3y ago
Google Authenticator makes it very unclear to average users how you back up or transfer stuff to other devices. Sites that support Google Auth are gonna have to deal with lots of locked-out users trying to recover access, which can negatively impact security.
If anything hopes to replace SMS, it needs to be as user-friendly as SMS.
- fishpen0 3y agoGoogle auth is not the only authenticator that supports TOTP. Any time a site tells you to use google authenticator you should be using a better service like 1password, bitwarden, lastpass, etc... to scan the QR code and store the TOTP code. I'm flabbergasted every time I switch jobs and some jamook in IT or Security says we have to sue google authenticator and that other authenticators aren't allowed. Then there are constant lockout events generating tickets for those teams when people delete the app or get new phones.
- hot_gril 3y agoYeah, it needs to be clear to users that they can use other things, especially some built-in option. Currently it's not.
- usea 3y agoMany services will happily remove the authenticator from your account if you email them and say you lost it. The whole thing is a joke.
- hot_gril 3y agoIndeed I was once ordered to implement oauth but keep the email password reset because too many people would get locked out otherwise. And I almost locked myself out while testing.
- lxgr 3y agoIt syncs everything to the cloud by default these days: https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/ https://arstechnica.com/security/2023/09/how-google-authenti...