17 ms·
My personal 2FA favorite is OTP + authenticator app. It behaves predictably and doesn’t have weird failure conditions. SMS 2FA tied to your mobile number suck
by devoutsalsa 1y ago
My personal 2FA favorite is OTP + authenticator app. It behaves predictably and doesn’t have weird failure conditions.
SMS 2FA tied to your mobile number sucks if it doesn’t support Google Voice, especially when traveling internationally and your SIM card isn’t in your phone.
Email 2FA usually works, but I just find it annoying.
App-specific push notifications mostly work, but it’s hard to debug if you don’t get the notification. For example, I recently bought a new phone and all of my apps were reinstalled when I restored from a cloud backup. For some reason app notifications didn’t work until I uninstalled & reinstalled the apps. And reinstalling the apps was a bit confusing because some of the apps were not available in the app store based on my physical location in a different country at the time.
- tptacek 1y agoTOTP isn't phishing-resistant, which is the whole ballgame. I've had the job of working on authentication for highly-targeted mass-market systems, and code-generators basically don't work: they raise the bar on phishing attacks to a level phishers still easily meet.
- goatsi 1y agoTOTP and SMS 2FA prevent credential stuffing attacks, which is very valuable considering how bad people are with password reuse and how many breaches with plaintext or weakly hashed passwords there have been.
- tptacek 1y agoYes, but other authentication factors also prevent credential stuffing, as well as phishing, which is probably the most important problem in authentication.
- kmoser 1y agoI hate email 2FA because I purposely don't have email on my phone. Unless I'm in front of my computer, I'm unable to log in to websites that use email 2FA.
- hollerith 1y agoHave you considered installing an email client on your phone, but not giving it the credentials it would need to fetch mail from the mailboxes you don't want to be tempted to look at when away from a keyboard?
- kmoser 1y agoIt's basically all one mailbox, but lots of forwards, so that wouldn't work. But my reasoning is not so much because I'd be tempted to look at email when AFK, but more for security: I don't want email to be accessible from my phone.