21–30 of 82 posts
These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/
> You definitely want to consider using these attributes if you are building a login form with the username and password on different pages.
These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/
Oy, me too, and though I love Twilio they are an offender here! What is the point of this pattern? Something to do with SSO validation or something?
The nice thing about using autocomplete with username and current-password is that it can help your password manager auto fill these fields across pages if they are implemented like this.
Earlier quoted context omitted.
A lot of people say that. But SMS 2FA is better than nothing.
Nope, not if it introduces common customer support backdoors.
Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option.
Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That would be news to me.
While Twilio does a lot right, they still only offer SMS and their own proprietary Authy solution for 2FA for their website. No TOTP (and still no plan to offer the industry standard) means that this has a whiff of hypocrisy.
Earlier quoted context omitted.
I know you're probably paid to do so, but please stop recommending that site operators use SMS for a second factor. https://www.issms2fasecure.com/
I’m actually paid to say that too ;) . In fact, SIM swapping isn’t the only weakness of SMS, take a look into the SS7 network and how that allows for a rogue operator to redirect SMS messages too. At Twilio, we have APIs for two factor authentication and we recommend implementing via push notification to the Authy app with “approve” and “deny” buttons. This is more secure and a better experience than SMS. The API als…
Earlier quoted context omitted.
I’m actually paid to say that too ;) . In fact, SIM swapping isn’t the only weakness of SMS, take a look into the SS7 network and how that allows for a rogue operator to redirect SMS messages too. At Twilio, we have APIs for two factor authentication and we recommend implementing via push notification to the Authy app with “approve” and “deny” buttons. This is more secure and a better experience than SMS. The API als…
If you allow fallback to SMS instead of TOTP, your solution may be more secure than no 2FA, but it’s no more secure than SMS either.
Earlier quoted context omitted.
I know you're probably paid to do so, but please stop recommending that site operators use SMS for a second factor. https://www.issms2fasecure.com/
I’m actually paid to say that too ;) . In fact, SIM swapping isn’t the only weakness of SMS, take a look into the SS7 network and how that allows for a rogue operator to redirect SMS messages too. At Twilio, we have APIs for two factor authentication and we recommend implementing via push notification to the Authy app with “approve” and “deny” buttons. This is more secure and a better experience than SMS. The API als…
This isn't always a good setup. Frequently implementors use SMS, once set up for 2FA, to do password resets.
This means that it's actually 1FA - get the sim, and you're in. No password required.
Earlier quoted context omitted.
I’m actually paid to say that too ;) . In fact, SIM swapping isn’t the only weakness of SMS, take a look into the SS7 network and how that allows for a rogue operator to redirect SMS messages too. At Twilio, we have APIs for two factor authentication and we recommend implementing via push notification to the Authy app with “approve” and “deny” buttons. This is more secure and a better experience than SMS. The API als…
> Ultimately I’d prefer SMS over nothing when it comes to 2FA This isn't always a good setup. Frequently implementors use SMS, once set up for 2FA, to do password resets. This means that it's actually 1FA - get the sim, and you're in. No password required.
I'm not advocating for poorly implemented 2FA, just that SMS 2FA is more secure than just a password.
If a site required you to have a 32 character length password, but kept the passwords in plain text, that wouldn't make your password any less strong. It just opens a different attack vector. If a site implements 2FA via SMS, but allows password reset via SMS it doesn't make SMS 2FA less secure, it makes that sites implementation incorrect.
Didn’t we just learn you shouldn’t use SMS 2FA?
A lot of people say that. But SMS 2FA is better than nothing.