Viewing profile — philnash

Ah, time zones. This is a real thing that happened to me so I wanted to share so that no one else ever finds out their date calculations are off by 9 months.

It’s a calculator to help you hit your financial goals by breaking down the formula showing you: - how many sales you need per day - how many sales you need per month - monthly tra…

Here's an idea about how to start with the mailbox sensor: https://www.twilio.com/blog/iot-mailbox-sensor-m2m-to-sms-fu... . This one sends an SMS when triggered, but you could cer…

I shy away from any rules that say you can’t mess something up simply by avoiding one thing, especially in this sort of case. Consider also that avoiding 2FA by SMS may avoid sim s…

There are a numbers of things here that are true. * Applications that take a phone number for one reason (2FA or otherwise) and also use it as a single factor for account reset are…

Further to this, it is also why I suggested the pattern workaround for older browsers. You shouldn't find yourself in too much trouble in a browser if you add an attribute to an el…

This allows a developer to have all the benefit of the Authy API, including enhancing the experience using push authentication or dropping back to SMS if needed, as well as allowin…

You are absolutely right and I don't know where I read that (or why I believed it, given I had the spec open at the time too). I've updated the post, thank you for your help!

The security hole there is using SMS as an account reset, which makes it a one factor solution (see other discussions of this in the thread). The error was in that implementation, …

Oops! Thank you for pointing this out, it is supposed to be "text". I have updated the post.

Absolutely correct, I've even given talks on this. Check out slide 52, I think we're in strong agreement here: https://speakerdeck.com/philnash/2fa-wtf-at-pycon-singapore?... . I'm…

But as I said towards the end of the previous comment, if you deem the threat to your users great enough that targeted SMS attacks are a problem, you can turn off that fallback.

The Twilio 2FA API actually allows you to generate secrets and QR codes for generic authenticator applications now. Check out the documentation here: https://www.twilio.com/docs/au…