161–170 of 296 posts
Earlier quoted context omitted.
The annoying part is most of them are very hard to move over to a new phone or backup
Do any of them work on desktops? I keep around a spare iPad to run my authentication apps, but I'd rather have it installed on my computer instead.
My strategy is to have a second phone that has Authenticator and is also the phone for any SMS based 2FA. The phone is locked in a file cabinet when not in use and never leaves my desk. An extra phone only costs me $10/month. Well worth the peace of mind.
You have to pay a monthly fee to own a phone?
Earlier quoted context omitted.
Google is also a culprit in this same way. Activate normal 2fa, but when you click forgot password, conveniently it says Should we send a code to your phone?
Note that it sends a code to your phone which is logged into your Google account , via a (presumably/allegedly, but at least it's not SMS) secure channel. (Actually, it doesn't send a code to your phone. It either sends a prompt to your phone, OR you can open a buried menu in some app to GET a - essentially TOTP - code.)
When I confirm the phone number, it sends a 6 digit SMS code prefixed with G-, like G-123456 The input box on page has already a read only G- text, & then a box for 6 digit code. After I confirm code from SMS, it gives the option to reset password.
Most of the forgot password ways to reset password is Tap on other Device prompt OR get a code from Google App.
Sample Google SMS to reset code with fictional number.
```G-007007 is your Google verification code.```
After I removed the phone number, now if i click Other Ways enough times, it simply says, give us the information about last time logged, creation date, some address I email frequently, & some other stuff, & sats it will take few days for them to get back to me.
Earlier quoted context omitted.
Followed by a six month government contractor bidding process, two years of development hell, and a half-based solution that either doesn't work or requires fifty extra convoluted steps.
Nah, it's cheaper and easier for them to mandate that the companies take care of it.
Earlier quoted context omitted.
Hi, which bank(s) offer this? > switch the 2FA to an authenticator on-your-phone code generator, which someone cannot hack easily. I remember looking a few months ago and they only offered SMS 2FA. Thanks
Sorry, I should've been more specific/accurate. I meant brokerages, like Fidelity, Etrade, Schwab -- where you're likely to have more funds/$ than a regular consumer bank. They do offer it. Even Amazon offers it. And you are right, I have not seen any of the banks I use convert to authenticator (BofA, Chase, etc). I can only guess that they think it's too difficult for the average consumer to understand or implement.…
Earlier quoted context omitted.
Hi, which bank(s) offer this? > switch the 2FA to an authenticator on-your-phone code generator, which someone cannot hack easily. I remember looking a few months ago and they only offered SMS 2FA. Thanks
Sorry, I should've been more specific/accurate. I meant brokerages, like Fidelity, Etrade, Schwab -- where you're likely to have more funds/$ than a regular consumer bank. They do offer it. Even Amazon offers it. And you are right, I have not seen any of the banks I use convert to authenticator (BofA, Chase, etc). I can only guess that they think it's too difficult for the average consumer to understand or implement.…
Earlier quoted context omitted.
I like not being locked out of my applications when my phone goes for an unexpected swim and I have to replace it. The numerous emails I get when I log in from a new device serve me pretty well, all things considered
Secure phones are sub-$200. If you have multiple accounts, services, etc, then backing up your 2FA codes, or registering two devices/phones at the same time should be on your radar.
A substantial number of services don't support this, which is a serious impediment to using 2FA both safely and securely.
Reminder: SMS 2FA adds only a negligible amount of security, if your company does 2FA via SMS you're doing nothing more than lulling your users into a false sense of security. Don't do it. Support proper 2FA. (And while you're at it, allow your users to decide how much they care about their account. Don't make the decision for them.)
SMS 2FA is, at best, just adding a little hassle for the hacker. If it's not a targeted attack, there's a chance that the extra effort means they'll move on, but that won't stop any remotely determined hacker.
Earlier quoted context omitted.
The difficulty there is evaluating which ones are reliable, secure, and easy to use. I'd welcome recommendations.
I personally use andOTP [0] which I'm a fan of. I've been thinking of switching to aegis [1] for nothing more than a UI change. [0] https://github.com/andOTP/andOTP [1] https://github.com/beemdevelopment/Aegis
Earlier quoted context omitted.
Note that it sends a code to your phone which is logged into your Google account , via a (presumably/allegedly, but at least it's not SMS) secure channel. (Actually, it doesn't send a code to your phone. It either sends a prompt to your phone, OR you can open a buried menu in some app to GET a - essentially TOTP - code.)
Oh no, if I cycle enough through Other Ways or I don't have my phone (while having my phone number connected with Google Account), it offers me to confirm my phone number with showing number as *** & last 4 digits. When I confirm the phone number, it sends a 6 digit SMS code prefixed with G-, like G-123456 The input box on page has already a read only G- text, & then a box for 6 digit code. After I confirm code from…