this post was submitted on 01 Mar 2024
381 points (99.2% liked)
Technology
59366 readers
3797 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's infuriating that my bank still uses SMS 2FA.
It's a circus out there...
One of my financial institutions supports yubikeys, but does not have the option to turn off sms 2fa. A chain is as strong as the weakest link, as usual.
Another only has sms 2fa and bizarrely allows me to specify any phone number at login time to receive the code. WTF?
Most only have 2fa via sms. When you talk about using an authenticator app people bitch and moan because they have to cut and paste those digits into the login page. Oh, the humanity...
Don't even get me started on sites with "roll your own" schemes, like forcing you to install their app (which requires all permissions under the sun) just to accept a push message and allow you to login on their website.
What if you don't have an Android or Apple smartphone, or refuse to get one on privacy concerns?
I know SMS isn't very secure, but how is one supposed to use 2FA if they can't, or won't, accept spyware to do so?
A lot of services now accept physical security keys for logging in. These keys use FIDO similar to how a phone-based passkey works. You just plug the dude in and then you are good to go.
Obviously not every company works with these just yet, but a lot of major companies do. Honestly most of the big tech companies support them.
GitHub and Bitwarden are the two I’m immediately thinking of, but that’s likely because I just used my passkey for those lol.
It’s way more secure than SMS MFA, and I prefer it to a phone app because I don’t have to look at then enter a code while hoping the time doesn’t run out for that code, forcing me to wait for a new one.
I've got some older unopened v4 Yubikeys that work let me have when they upgraded to v5. I've been meaning to try them out. Problem is there's no backup. If you lose or break the thing, you're screwed if you didn't have some alternative 2FA set up.
I programmed 3 of them for my Bitwarden login. One stays on my keys and the other two are in my desk at home and the fire safe. Could go as far as sticking one in a safe deposit box.
Any time TOTP is an option, that goes into Bitwarden. Done.
Now passkeys are becoming a thing and those will also go into Bitwarden, personally.
That's fine if you don't want to use a smartphone, but SMS should not be the only option available. They should provide multiple options for 2FA so customers can choose what they are comfortable with.
100% agree.
You can use TOTP 2FA on a browser too, there’s plugins for it. It’s not some super secret algorithm, smartphone apps are just the most common way of handling it. I suppose there’s progress to be made in terms of accessibility and education for the general public in terms of options for TOTP.
That's a good point, and I do have some 2FA set up like that. The problem is I have to be logged into a computer, have a browser open, have the 2FA extension installed, and be able to copy and paste or type the code in before the timer expires.
That's not hard at home, but if I need to sign in to my bank account while at a library or anything like that, I'm screwed.
I think SMS is popular because it's so easy to reach the people that need the codes, regardless of platform. I just wish it wasn't so bad security-wise, you know?
TOTP isn't offered by most of my financial sites, or Apple. It's annoying.
That’s because Apple, as they love to do, decided to make their own special version of 2fa within their little garden.
Y’know, instead of going with the accepted totp method.
Mine uses SMS 2FA AND had a 16-character password limit. I need to switch banks already. Any suggestions for a decent bank or credit union that uses modern password cryptography and app-based TOTP?
Well Capital One still uses SMS 2FA ... BUT if you're going to be using budget apps they allow OAuth which was the big selling point for me (i.e. not giving my bank account password to a third party)
SMS 2FA is dumb, but I thought 16 characters are okay right now. Does the bank have too many password mistakes will block you for a certain time period enabled?
They're good as long as there aren't any limits on characters you can use.
Some people like to use passphrases. But honestly, the gold standard is a password manager with randomized strings.