5 ms·
It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go t
by jjice 1y ago
It really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me.
It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.
- unethical_ban 1y agoI absolutely cannot stand that no bank I have (US) supports generic TOTP, which is more secure and easier to recover from backup if my phone is broken or stolen. It's inexcusable.
- UncleMeat 1y agoTOTP is only marginally more secure. It defends against sim swaps but it still loses to phishing, which is far more common than sim swaps.
- unethical_ban 1y agoBut it is easier to backup and restore, is accessible without a phone, and can be used without cell service.
- UncleMeat 1y agoThose are usability benefits rather than security benefits and I really don't know if I'd use the word "inexcusable" for this difference. And for the vast majority of people, sms is much easier to backup and restore than totp because there is an infrastructure to help them do so.
- _bin_ 1y agoThis is probably compliance-related. For me, TOTP isn’t “something I have”, it’s another thing I toss into my password manager and sync to all devices. I really agree with it, but that’s probably their rationale.
- connicpu 1y agoI do the same, and it somewhat defeats the spirit of 2FA, but I still believe it's more secure. It's basically a second password where intercepting it in transit once isn't enough to be able to repeat the login in the future.
- unethical_ban 1y agoOne time password. Yes, a digital OTP generator is more susceptible in theory to theft or duplication than a hardware token. Yes, the benefits of digital OTP are great compared to password only, more secure than SMS, and trivial to implement.
- deleted 1y ago[deleted]
- lxgr 1y agoThe real problem is not having a (trusted) way of seeing what you are consenting to by entering a TOTP (which can be phished). SMS-OTP, with all its downsides, allows attaching a message of who you're paying how much to the actual code.
- Sargos 1y agoBanks didn't support TOTP long before we were able to easily sync them across devices. It's likely more along the lines of banks generally have bad IT departments and outdated digital security policies.
- throitallaway 1y agoThat same rationale wouldn't support SMS as "something I have." iMessage and other solutions easily spread SMS into cloud and PC lands (ones that are more easily accessible than password managers.) More likely it's because of legacy and "good enough" reasons. Personally I don't put TOTP tokens into my password manager and keep a dedicated app for it, just in case my password manager is pwned.
- _bin_ 1y ago
- fortran77 1y agoBy brokerage suports TOTP but not my bank. My bank does support Yubikey-type devices though.
- throitallaway 1y agoVanguard supports Yubikeys. I'm yet to use a bank (~8 of them so far) that supports anything other than SMS.
- fragmede 1y agoThere is at least one major US bank that supports Yubikeys and a different major that one supports (with some convincing) phone notification-based second factor.
- lxgr 1y agoTOTP is alright for logins, but it's generally very phishable. For transaction confirmation, not being able to tie a code to a given recipient and amount is somewhat of a dealbreaker.
- lldb 1y agoAlthough they don't offer TOTP, I've noticed growing support for Passkeys which is a step in the right direction.
- fragmede 1y agoFwiw, Symantec VIP is TOTP under the hood, and you can extract the seed with some hackery. There is at least one financial institution in the US that uses that.
- unethical_ban 1y agoUSAA. Better than nothing, but since it doesn't do push notifications it's a needlessly proprietary piece. It's probably a combination of legal and a slow IT infrastructure.
- quinncom 1y agoCharles Schwab uses this. I was able to extract the TOTP secret during the set up process to use in my preferred auth app.
- jdofaz 1y agoCopper State Credit Union supports passkey
- BenjiWiebe 1y agoI've been using Citi and Discover for years with a Google Voice number. Possibly I've been grandfathered in though?
- ravenstine 1y agoExecs at those companies probably think "Google = good".
- notyourwork 1y agoYet Facebook won’t let me sign into WhatsApp using my GV number alone.
- BenjiWiebe 1y agoThere must be something unique about my GV number. It's even allowed on WhatsApp (knock on wood). I registered it about 13 years ago. I didn't transfer it from a landline/cell phone, it was picked from a list of Google Voice numbers available in my area code. I've never had Fi.
- lxgr 1y agoI don't think SMS senders can actually tell the difference between Google Voice and other VoIP providers.
- quesera 1y agoTwilio has a lookup API, which returns the subscriber name and carrier. Here's an example response (subscriber name redacted): { "data": { "name": "LASTNAME, FIRSTNAME", "line_provider": "Google/Bandwidth.com (SVR)", "carrier": "Bandwidth.com", "line_type": "landline" } }
- lxgr 1y agoAh, I always assumed Google uses Bandwidth.com completely transparently – I wasn't aware there's a separate level of "line provider" look-up available. Thank you!
- connicpu 1y agoMay vary by institution, but both banks I have accounts with also support having a robot call my phone where I can confirm the login. That should at least work with WiFi calling.
- yfontana 1y ago> It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps. It never ceases to surprise me how much American banks always seem to lag behind with regards to payment tech. My (european) bank started sending hardware TOTP tokens to whoever requested one like a decade ago. They've since switched to phone app MFA.
- jabzd 1y agoWe actually had it that way on accident in a few of our applications - we had a `#isTextable(e164)` function that would do a carrier lookup and voip carriers sometimes returned as landlines or as arbitrary values that didn't mean mobile. We eventually did some work to refine that function to be smarter and actually better represent if the number was textable. At least for us, it wasn't a conscious decision, it was a gate being aggressive in our SMS pipeline.