3 ms·
Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is lig
by sedatk 1y ago
Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP.
Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but cell operators have workarounds in place for that. It's getting better.
I don't even know how recovery scenarios work for passkeys.
- sneak 1y agoPrecisely nobody is suggesting that there be no recovery mechanism. This criticism is a red herring.
- sedatk 1y agoWhat do you think such a recovery mechanism would look like without SMS?
- Uvix 1y agoSyncing the TOTP credentials from a cloud account of some sort (iCloud/Google for the masses, Bitwarden or another password manager for more technical users) to the device. As a fallback recovery mechanism, offline backup codes generated at the time the TOTP is applied to the account.
- sedatk 1y agoThen you make Google/iCloud the point of entry to someone's bank account. That completely changes the threat model for customers, and possibly for worse than SMS. Offline backup codes, when printed, isn't such a bad idea. But when you lose that piece of paper, again, game over. SMS is fantastically resilient to these scenarios. There's a reason banks insist on using it.
- Uvix 1y agoSMS isn't resilient to the worker at the local retail store for the phone carrier giving someone else a SIM for my phone number. That's a much bigger threat vector than Google/iCloud/a sync target I manage storing an encrypted version of the TOTP credentials.
- kbolino 1y agoHow realistic is this threat? I would think that the employees would have to jump through hoops that require you to be present (or at least a lot more of your info to be stolen than just your name and number) and that the home network would detect a duplicate E.164 number with conflicting IMEI/IMSI numbers and locations pretty quickly.
- kbolino 1y agoFWIW: https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam This is more like confused deputy than collusion (though that can happen as well), but nevertheless the end result is somebody else ends up with your number, and your device gets deactivated.
- justsomehnguy 1y agoIf I lose my phone I can go to the office of my carrier, present my ID and receive a new SIM with the old number[0]. If Apple/Google decide what I'm not their customer anymore then I have literally zero ways to recover anything from them. [0] and half a year later the bank would finally found out about and block the SIM 'to prevent fraud' at the most inconvenient time. But again, it's solvable with a visit to the office and an ID.
- Detrytus 1y agoPassword managers, such as KeePassX can generate TOTP codes. And Keepass database is just a file, you can have as many backups of it as you want.
- sedatk 1y agoYou overestimate a regular person's technical skills and their capability of planning resilient backup strategies.
- loeg 1y agoShow up in person with ID.
- sedatk 1y agoYes, but remember, the original scenario was person leaving Canada, and trying to use their Canadian bank account from the US. There is nowhere to show up. But, if they could swallow SMS roaming costs temporarily, they could access to their account easily.
- loeg 1y ago> There is nowhere to show up. There's Canada. And yes, re-enabling a SIM and paying a handful of roaming SMS charges might easily be more convenient than traveling to Canada.
- kube-system 1y agoThat's not necessarily possible. Many banks do not have physical locations, and many people do banking business while physically away from a bank. https://en.wikipedia.org/wiki/Direct_bank https://en.wikipedia.org/wiki/Direct_bank
- loeg 1y agoWe're talking about recovery mechanisms, not day to day regular banking interactions. Ultimately, if there isn't a physical branch you can show up to easily, your access recovery time might be pretty inconvenient. This would be a good thing to consider when selecting a bank.
- kube-system 1y agoOnline only banking is fairly popular for traditional banking services, and wildly popular when you consider money transmitters, lenders, and investment brokerages. Whatever the problem you think they have with authentication resets -- much of the financial market seems to have solved the problem well enough without in-person resets to have successful mainstream businesses.
- mixmastamyk 1y agoMFA is more than 2FA. You'll typically mandate several ways to get in, ahead of time. Whether a third logical device or printing out recovery codes. For something as important as a bank, folks will comply.
- sir_brickalot 1y agoCounter: Backups for TOTP are easy and you can use multiple devices/services for a single TOTP login.
- kube-system 1y agoWhether it is easy or possible is irrelevant. For the 99.7% of the world that isn't a software developer, the real-world observed use case will predominantly be the least-friction commoditized workflow. People mostly have one phone with one authenticator app, and that's what they'll use.
- TingPing 1y agoYou aren’t wrong. It is built in to Googles and Apples though, should be widely used.
- raron 1y ago> Losing TOTP is easy. Lose your phone and it's gone. That is the main point of it. That's why it is called a second factor. > It means game over for a regular person. It just means you have to go to the nearest branch.