3 ms·
I don't get why Apple and Twitter don't support TOTP. It makes their 2FA useless for lots of people.
by lucian1900 13y ago
I don't get why Apple and Twitter don't support TOTP. It makes their 2FA useless for lots of people.
- e1ven 13y agoTwitter already has a huge infrastructure for SMS, reusing it makes some sense from an internal-logic standpoint.. For Apple's use-case, their users already have phones, and understanding TOTP would make it harder. Push notifications are already pretty straight forward, so building on top of that also makes sense. For Google, for instance, I often use their SMS verification rather than going to the authenticator anyway - It's faster, easier, and gets me logged in. It still raises the barrier of entry versus just guessing my password.
- lucian1900 13y agoI don't think they should remove SMS support, but that it's not sufficient on its own. At least for me, TOTP is much faster than SMS would be: request it, wait for it to arrive - if I have good signal, get to it on my phone vs. open the authenticator app and read one of the codes.
- nivla 13y agoI agree. I love the idea of TOTP. It is not tied to a specific vendor or app and it doesn't require a internet connection to work. The only issue I found was there is no way to change the default timeout of 30 seconds and 30 seconds maybe more than enough to brute force a 6 digit numerical phrase.
- lucian1900 13y agoIt's likely not enough time, since the website you're logging in to can forbid that many passwords from the same token in a short amount of time.