3 ms·
No "tons" of systems do not do this. If you come across one that does it was built by a team that has no idea about security. TVs etc. are special cases becaus
by paxys 2y ago
No "tons" of systems do not do this. If you come across one that does it was built by a team that has no idea about security.
TVs etc. are special cases because obviously there is no way to redirect to them, and even there developers will always have some kind of secondary checks like having you enter a code displayed on the screen.
- edoceo 2y agoWhen I sign on to a bank it sends an SMS. Then my phone prompts me to share that code with the brower, on my desktop. It's a neat QOL "feature" - but kinda feels too automated to be secure.
- lupire 2y agoThat's because the server recognizes both clients, and you are prompted to approve the other client from the client that has the code. You are giving permission to the remote client, not taking permission from the remote client.
- edoceo 2y agoThe server recognized my device from the messenger/SMS app? That seems not correct. But somehow, the desktop browser and my mobile are tied together for this app. But no other sites have this magic.
- happyopossum 2y agoIf you have an iPhone and a mac, most sites that use SMS OTPs work this way
- edoceo 2y agoLinux desktop, android phone.
- Groxx 2y agoI've come across dozens. Google does it. Paypal does it. Duo does it. Lots of single-sign-on systems do it. All of those including not-TV scenarios, just normal computer-and-phone stuff, as well as sometimes other weird flows. Many of these are far beyond what most would label as "security competent", into "login security is a large part of their business and they have significant numbers of specialists hired". (it is probably safe to say none are "truly secure" or "actually security obsessed", but I doubt that's actually possible in large quantities. the requirements are too steep, for both implementers and users.) It's not the most common, certainly, nor anywhere close. But it's very far from nonexistent.