91–100 of 107 posts
I've only ever signed up for such sites from my desktop, so it was easy to use my phone or tablet camera to get the QR code from my desktop's screen.
How do you scan a QR code that is on your phone's screen using your phone?
Earlier quoted context omitted.
No, Google Authenticator does not securely store keys anywhere but your physical phone. If you lose your phone, they're gone. The only thing it provides is a way to export from one device to another, but that requires having the first device still with you. [1] On the other hand, yes fortunately Authy does provide cloud backups. But your average end user generally doesn't have the slightest idea of why they should us…
Note that the export on the source device doesn't seem to have any way to actually know whether or not you are actually setting up a new phone. It just makes QR codes with the keys for groups of accounts that Google Authenticator on a new device can scan to import those accounts. I can't see any reason you couldn't start the export process without having a new phone and take screenshots of the QR codes, then back tho…
But in practice it's utterly ridiculous. I already do all this work to store passwords in a password manager.
Now I'm supposed to have an entire separate backup strategy for 2FA that depends on screenshotting QR codes or remembering to save their text equivalents? It's just crazy user-hostile.
Earlier quoted context omitted.
Nobody in my family - parents, kids, spouse - knows what an authenticator app is or would what to do if presented that as an option, although my teen could probably figure it out. For everyone else, it would be a cascading series of installation and password and app switching and immediacy problems. This would create a great deal of frustration, and ultimately a call to family tech support (me) or the service provide…
The biggest hurdle to authenticator app adoption for the masses is the one that only bites you a year or more down the road when you get a new phone. If you didn't transfer your seed info over to the new phone before trading in the old one, you are locked out of all your accounts.
The other issue is that many smartphone owners don't have a computer they would back things up to. Just "cloud".
Earlier quoted context omitted.
My credit union supports TOTP. They also sent me a one time code generator thingy that I can use as a 2nd factor. Trouble is, there's a big link on the login screen that will allow anyone to bypass those options and fallback to SMS or email.
The real meat is in password recovery options.
The head security guy at USAA and I had a talk where he explained in some detail how it all went down. He was refreshingly honest, and they didn't balk at getting our funds restored, but still -- humans are often the weakest link when they can defeat all of your security precautions. Probably the bank shouldn't give phone reps that much authority, and always require a dedicated security team response for such unusual situations.
Earlier quoted context omitted.
Elon Musk said that they were being fleeced by SMS fraud when the change was announced.
And not for blue? It’s just a lame excuse foe the insane price of als using twilio. If he stated the truth: sms validation is costing millions per week, twillio would lose quite some customers, because companies would finally realize there’s another way that’s cheaper
Earlier quoted context omitted.
my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone
I use Strongbox to backup TOTP in Keepass databases.
Earlier quoted context omitted.
I use Strongbox to backup TOTP in Keepass databases.
TOTP is only needed if you use very a weak password, which shouldn't be a thing with keepass.
Earlier quoted context omitted.
And not for blue? It’s just a lame excuse foe the insane price of als using twilio. If he stated the truth: sms validation is costing millions per week, twillio would lose quite some customers, because companies would finally realize there’s another way that’s cheaper
Blue means they’re spending $10 a month or whatever it is. No fraudster is gonna buy a VCC for Twitter Blue and pay $10 an account when there are a million other sites they could target for $0.
And I fully agree with him
Earlier quoted context omitted.
TOTP is only needed if you use very a weak password, which shouldn't be a thing with keepass.
What if your password is leaked from some website’s database or you have a keylogger or someone somehow sees it? Wouldn’t it help then?
If you have a keylogger, it will just steal your TOTP.
Another technology to read up on is Silent Network Auth: https://www.twilio.com/blog/silent-network-authentication-sn... If you operate a mobile app, this allows you to force a data packet over the device’s SIM that the carrier can validate. Platforms like Twilio/Boku have worked with the carriers to provide an API for this. SMS is completely removed from the process and SMS pumping becomes a non issue. Another optio…
