4 ms·
Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't
by Lagged2Death 14y ago
Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't even have an option for "I don't have a cell phone, please stop nagging me about this."
- nodata 14y agoYes you are, and I suspect you know this. Even in most third world countries cell-phones are common.
- acqq 14y agoStill, if I plan to use Google Authenticator, I don't want to give Google my phone number at all. When they insist to get the phone number from me, I don't like it.
- nodata 14y agoAre you talking about Google Authenticator the Android app, or the SMS service?
- pooriaazimi 14y agoI don't think you need to get them a phone number. I use Google Authenticator app on my iPhone, and didn't give them anything. It just scanned a barcode on a webpage IIRC.
- zumda 14y agoThe bar code was actually just a code to initialize the code generation (I think it is based on that randomly generated seed and the time, so that then server and client generate the same keys). You could have also typed in the code by hand.
- pooriaazimi 14y agoYou're absolutely right. My parent was talking about giving Google his/her phone number, which I was responding to :)
- _delirium 14y agoHow do you get 2-factor auth enabled at all without entering a phone number? Their help page says that you can switch from phone-based to Google-Authenticator-based authentication after enabling 2fa, but I can't find a way to skip the phone step for turning it on in the first place. This is the screen I get when I click to enable: http://i.imgur.com/cm6Km.png http://i.imgur.com/cm6Km.png
- obiterdictum 14y agoSorry, a bit off-topic, but that reminded me of one fun fact. In Russia, most social networks these days require that you sign up with a mobile number. You cannot start using your account without receiving an SMS verification code.
- sigkill 14y agoIirc, even facebook nowadays (at least in India) requires you to complete SMS verification during account creation.
- dagw 14y agoBuy a $20 used phone and get the cheapest pay-as-you-go plan you can find (you'll only be using the phone to receive text messages, so it should be really cheap) and consider it a somewhat impractical Google Authenticator hardware dongle.
- dredmorbius 14y agoNote that even a cheap, pay-as-you-go phone emits a breadcrumb trail of mobile network (and possibly GPS) location information. Unless you power it down between connection attempts. In which case it still emits breadcrumbs, though fewer.
- Lagged2Death 14y agoPerhaps I meant it as a half-rhetorical question; I'm not the only person I know who doesn't have a cell phone, and if you take moment to consider it, I'm sure you'll realize that you know some people in the same position. There are in fact significant demographics - children and the elderly - where cell phone adoption is rather low. Ironically enough, these are the very groups where enhanced security measures may be most useful.
- jonknee 14y ago> if you take moment to consider it, I'm sure you'll realize that you know some people in the same position. Actually no, I can't think of anyone. Buy an iPod Touch and install Google Authenticator, you will have all the inconveniences of not having a phone but enjoy the security benefits of two-factor authentication.
- nagisa 14y agoNo he isn't. Some people (like me or he) are just not stupid enough to buy a device, which would be used on average only once a month.
- nl 14y agoYou can run the Authenticator app on an iPod. But 2-factor does mean there in an expectation you will have to carry some kind of token device.
- _delirium 14y agoYou shouldn't have to carry an electronic device, though: a list of codes on paper can work fine. That's how the NemID system works, for example (http://en.wikipedia.org/wiki/NemID http://en.wikipedia.org/wiki/NemID): I have a big list of challenge/response codes that I carry in my wallet, and each is used once. I use that one successfully to log into my bank with two-factor authentication, but since I have no cell phone, iPod, iPad, or Android device, I can't use Google's version. What's weird is that Google even sort of supports the numbers-on-paper approach, but for some reason they limit it to 10 numbers. edit: Hmm actually thought of a possible solution. Looking into how hard it'd be to port the Google Authenticator to a non-mobile platform so I can run it on my laptop. edit2: Although it looks like you can't enable the Google Authenticator method without first enabling the SMS method...
- shawabawa3 14y ago>edit: Hmm actually thought of a possible solution. Looking into how hard it'd be to port the Google Authenticator to a non-mobile platform so I can run it on my laptop. Just install an android emulator, e.g. YouWave, and use that virtual android device to run GA.
- tedchs 14y agoGoogle Authenticator uses the standard OATH protocol (note, this is not OAuth): http://www.openauthentication.org/specifications http://www.openauthentication.org/specifications
- maxerickson 14y agoThere is a windows version, and various java versions, and still others: http://en.wikipedia.org/wiki/Google_Authenticator#Implementation http://en.wikipedia.org/wiki/Google_Authenticator#Implementa...
- doskir 14y agoBuy a cheap used phone and a prepaid card, you should be able to get by just "recharging" 20$ of credit every 6 months or so.
- stephengillie 14y agoWhy are you the only person in the world who doesn't have a cell phone? Why would you assume that super-large companies would consider your single-person use-case?
- sjlo 14y agoYou can use a YubiKey for Google 2-factor along with a helper app like Yubikco's "sidekick" for Windows [1] or my company's OneTime on Mac [2]. A YubiKey costs about $25 but is very portable, fast and convenient option. [1] http://yubico.com/totp http://yubico.com/totp [2] http://zetetic.net/software-onetime http://zetetic.net/software-onetime
- deleted 14y ago[deleted]
- ralph 14y agoDid you know it can provide a one-time pad of ten verification codes to print out and store and it will provide another batch on request?
- hnwh 14y agoI also don't carry a phone, and feel the same way as you about this
- tokenrove 14y agoNo; I know dozens of people, including myself, who do not have cell phones, and have no intention of getting one. I find this an extremely obnoxious assumption by Google (and others) -- it's not like we're luddites; it's frequently the programmers I know who are least willing to carry a cell phone.
- aoprisan 14y agothe assumption is made that 99% of customers would have a cell phone and thus invested engineering resources into it