51–60 of 65 posts
I would argue that Namecheap shouldn't be on that list. They send out a 6 digit code and then immediately tell you what number it begins with, reducing the code to effectively 5 digits. Their continued refusal to support RFC 6238 shows they don't take this seriously in my opinion.
TradeKing definitely needs to be added to this list. They should be prominently featured at the top in a security hall of shame for their cartoonish security. Edit, examples: No 2 factor authentication Displaying the answers to your security questions in multiple choice form (with a none of the above option, but usually including your answer). Requiring your password to be entered with mouse clicks at an on-screen ke…
2FA is trivial to add. https://www.authy.com/ Just do it.
Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would be a big advantage - I'm worried about losing my phone even with backup codes in my wallet. Worst case situation is that I'm robbed and have to hand over phone and wallet! Also, I'm not aware of Google Authenticator being updated. Which makes me concerned that it'…
Things with backup or sync are risky, they add additional ways your authenticator can be compromised. There's an alternative that's similarly useful, but far more secure. When you add a 2FA code, print the QR code presented by the website and store it somewhere very secure in real world space. You can later scan it with any TOTP app, and it'll add the identical authenticator to another device.
It's great that this exists. Many typical users are still befuddled by multifactor authentication, and the one thing that helps is practice. Unfortunately, by having all these islands of identity, the frequency of interaction for many of them ends up being low, resulting in users forgetting they enabled MFA and the associated recovery costs. There have been technologies to try to bridge the identity islands -- social…
Citibank does support it, but only on their "Gold" accounts.
The TOTP stuff will never be widly used. Its just a total pain to work with. SMS is also very suboptimal. I have more hope for U2F as second factors go. That is at least easy to work with once you have bought the token. I find it a joy to use.
> The TOTP stuff will never be widly used. Its just a total pain to work with. I'm not sure I agree with that. Generating a code: makeQRCode(); Validating a code: validateCode($_POST['2facode'])) { // Login successful } } Then you can just use the 2FA app of your choice (Authy, Google Authenticator, etc.), scan the QR code, and you're good to go.
The fact is people hate typing stuff from their phone into their computer. Specially if you phone is not always within reaching distance. If you have to do it with tons of different logins you will be annoyed. As long as you have 1-2 accounts its fine, but if we really want to role it out everywhere, we need something better.
TradeKing definitely needs to be added to this list. They should be prominently featured at the top in a security hall of shame for their cartoonish security. Edit, examples: No 2 factor authentication Displaying the answers to your security questions in multiple choice form (with a none of the above option, but usually including your answer). Requiring your password to be entered with mouse clicks at an on-screen ke…
Please consider sending them a pull request: https://github.com/2factorauth/twofactorauth/pulls
It always wondered me why my bank can't offer my 2FA with SMS code, but Steam or Github can?
Banks have rules and regulations to adhere to. You'll notice almost all banks have universally the same additional types of security (like the security image/security phrase) and such. Because those fit within the industry standards.
I recently forgot my phone at university and realized that I was potentially locked out of many websites.
Earlier quoted context omitted.
> The TOTP stuff will never be widly used. Its just a total pain to work with. I'm not sure I agree with that. Generating a code: makeQRCode(); Validating a code: validateCode($_POST['2facode'])) { // Login successful } } Then you can just use the 2FA app of your choice (Authy, Google Authenticator, etc.), scan the QR code, and you're good to go.
I have implemented this before. I have it in production right now. The fact is people hate typing stuff from their phone into their computer. Specially if you phone is not always within reaching distance. If you have to do it with tons of different logins you will be annoyed. As long as you have 1-2 accounts its fine, but if we really want to role it out everywhere, we need something better.