291–300 of 328 posts
Earlier quoted context omitted.
> SMS is the only 2FA method that can be easily deployed at scale No, no, no, no, NO. No it's not. And you have zero proof of this. Its done this way because its the lowest effort to give security theater.
What's the actual method that can be easily deployed at scale then?
> you have to download an app to do it, it's not just a capability that a phone has by default Luckily this is starting to change. Apple's Passwords app does TOTP out of the box. Though I am mystified why Google Authenticator doesn't come pre-installed in Android.
Doesn't this kind of defeat the purpose of MFA in that you now have both factors within the same application?
> you have to download an app to do it, it's not just a capability that a phone has by default Luckily this is starting to change. Apple's Passwords app does TOTP out of the box. Though I am mystified why Google Authenticator doesn't come pre-installed in Android.
Doesn't this kind of defeat the purpose of MFA in that you now have both factors within the same application?
2FA codes solve that because you can't reuse them between websites so one website getting hacked doesn't expose all of them.
Earlier quoted context omitted.
Anything else could be lost. I can always get new SIM card for this number. I don't need to backup it and I can't accidentally delete it. That's the biggest reason for me to link phone number everywhere. I'd hate to lose access to my GitHub account.
It's also not very hard for scammers to get a SIM card for your number, unless you're using a carrier that specializes in not allowing SIM swapping attacks.
Earlier quoted context omitted.
I have been living outside the United States for twelve years. I always had problems with SMS until I got Google Fi. And that's a problem because, as the article here says, many banks insist on SMS these days. There are various services that give you a virtual number. But they always suffer from one of two problems: (1) VOIP numbers are 'blacklisted' by some banks for security reasons: they want a real cell phone num…
>Google shuts off the data on Fi after you've been outside the USA for a month. No problem, I'm happy to pay $25 a month for a 'dataless' connection that gives me SMS and voice. To be somewhat more specific: while I travel extensively and am in the US often, I am often outside of it for more than a month at a time, and it appears that Google will shut off data outside the US if you use data outside the US for too lon…
Perhaps it's country dependent? Or based on other metrics? I wasn't a heavy mobile data user, but didn't intentionally avoid it either...
Check your service password reset flow – is it a phone number input? It was 1FA all along.
Earlier quoted context omitted.
They always had internet access. Of course it is possible that they decided to rip out the internet connection in the new models together with the touch screen, but I heavily doubt that they want to trust the internet connection of a random stranger to do whatever important communication they have to do with their servers. The app only requires internet access because... well, it always needs internet access.
I'm currently developing firmware that supports both Bluetooth and cellular connection for a hardware device. With proper cryptography, you don't have to trust the random stranger (e.g. using TLS). In fact, you can get away with no connection at all. For example, when someone locks the locker, it sets a "password" via Bluetooth and when you open it, your phone simply transmits the "password" via Bluetooth.
> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I r…
If you port your cell number to a VOIP carrier, I don’t think senders have any way of telling that it’s not still a regular cell number? I have such a ported number and have no issues receiving SMS 2FA codes.
If nothing else, if a particular voip provider only does voip, you can just put them on a blacklist. You can get any number's provider from the number portability clearinghouse (this might be country dependent, where I live, there's only one, and anyone can query it).
That said, I still would prefer both over another shitty authenticator app that really gets on my nerves.
Additionally, I would like an option toggle with "Yes, I do have a safe and uncompromised password", where I can get rid of this crap.
Some 2FA systems do work if they don't ask more than once a month, but they are the exception.