31–40 of 96 posts
Earlier quoted context omitted.
The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.
Google authentication is great, until it's time to get a new phone.
For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users. I would rather be hacked than deal with 2FA.
The right way to do it is to use client-side TLS certificates in combination with the username and password. Add in a passphrase for the private key and you could have 3FA. All that's really needed is for browser vendors to improve their UI for generating certificate signing requests and importing certificates.
Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
What is the difference between an extra branded physical token and a 2FA app, such as Authy, on your phone?
How to fix it? Create two accounts -_-.
LastPass and bitcoin.de also don't support multiple devices.
Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
Strange argument. What is this 'big powerful Outside of your control'?
Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
What is the difference between an extra branded physical token and a 2FA app, such as Authy, on your phone?
My phone is a connected device, monitoring me constantly outside my control, controlled by the most powerful data mining companies in the planet. I simply can't trust my phone. I can trust enough my physical offline devices and if it will be cracked sometime I'm completely not responsible for it, my bank is. While with my phone it's really easy to say "it's because of this or that, not our faults" where this or that can be anything from unupdated fw (by the vendor, of course), unsafe apps installed, ...