3 ms·
I hate 2fa based on SMS or voice auth. Requiring proving control of a number is decent as an anti spam or flooding technique, but is horrible for authenticatio
by rdl 12y ago
I hate 2fa based on SMS or voice auth. Requiring proving control of a number is decent as an anti spam or flooding technique, but is horrible for authentication of anything high value enough to justify 2fa.
I also strongly prefer 2fa systems which allow me to enroll my own hardware token or use a software token (eg AWS IAM) vs systems which supply the seed so I can't (CloudFlare is depressingly the only service I use which still suffers from this, despite being otherwise pretty awesome.)
- shurcooL 12y agoI really dislike SMS-based 2FA and do not use it at all. Imagine you're traveling, now you may have to pay 75 cents just to login somewhere. Google Authenticator-based 2FA avoids all these problems.
- rdl 12y agoMy problem is that banning cellphones and blocking cell signals is common in secure spaces, so cell based 2fa fails there, too.
- iagooar 12y agoHow can you pay for incoming SMS?
- rdl 12y agoRoaming, or USA.
- greenpresident 12y agoThere are no roaming charges for incoming SMS in the EU.
- TillE 12y agoTo clarify: there are no charges for incoming SMS to EU numbers, no matter where in the world your phone happens to be.
- shurcooL 12y agoAnd Canada.