3 ms·
My bank recently added the feature of removing SMS as an 2FA option - requiring TOTP. Now if they'd only add webauthn, but TOTP is pretty secure against phishin
by zamalek 3y ago
My bank recently added the feature of removing SMS as an 2FA option - requiring TOTP. Now if they'd only add webauthn, but TOTP is pretty secure against phishing with a browser-integrated password manager (no autofill results in suspicion).
- s1dev 3y agoWhat bank is this and are they available nationwide?
- zamalek 3y agoFirst Tech CU. Their physical locations are PNW only, but that hasn't stopped me from continuing to use them electronically on the east coast. They are also part of the CU alliance, so access to alliance branches and ATMs is possible (I've never had the need to test this).
- Hnrobert42 3y agoYes. Why are banks with TOTP so rare?!
- unethical_ban 3y agoI have no idea, and I despise it. USAA and eTrade both have TOTP, exclusively with the shitty, non-backup-able Symantec VIP app. Break your phone? You're boned! Symantec VIP on those sites don't provide 2FA verification (the thing where the phone asks to confirm the number on the client-side) and it doesn't provide push notifications. It's literally a worse version of regular TOTP. And they're in the minority even having 2FA!
- umbra07 3y agohere you go! https://gist.github.com/jarbro/ca7c9d3eebba1396d53b4a7228575948 https://gist.github.com/jarbro/ca7c9d3eebba1396d53b4a7228575...
- Aaronn 3y agoThis works for Charles Schwab too!
- umbra07 3y agoand fidelity!
- tekknik 3y agoWhat could possibly go wrong using an open source project for authentication against your bank accounts? Where have we seen this before? You best audit the shit out of that code if you actually use it. Every. time. they. update.
- eco 3y agoMy bank finally added 2FA today actually. It is, of course, SMS or Email only because banks the worst online security for reasons I'll never understand.