this post was submitted on 01 Mar 2024
288 points (99.0% liked)
Technology
59219 readers
3980 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's a great recommendation to use app-based 2FA, except that lots of services seem to insist on and only offer SMS OTP.
For instance out of all the financial establishments I do business with, only one offers the option. The big name players don't, it's only some tiny little mom & pop CU that does.
It's very much a business adoption issue.
App-based is also unacceptable if it’s a proprietary implementation
TOTP/HOTP are the best standards right now
I like a combo of Yubikey and Bitwarden, personally.
Yeah, Yubikey fits - it implements TOTP/HOTP, and bitwarden is great
Just “app-based” worried me about apps rolling their own implementations instead of using standards
Have you ever used HOTP before? Convenience-wise, it's much worse than TOTP. It's not supported by popular apps, you can't use it on several devices unless there's synchronization, you never know if the code you're looking at was used already.
Yeah, it’s much less convenient. I prefer TOTP, but I will pick HOTP over Cisco Duo’s proprietary implementation that I can’t use without their specific app if those are my only options
Not sure if you do business with them, but Charles Schwab does have a app-based MFA option - although that’s limited to Symantec’s own TOTP MFA.
A lot of sites say they only support one specific MFA app. But in my experience, any MFA app that can read the QR code will work.
I don't know how/if I could generally cite my sources, because I'm just anecdotally referring to the services that I happen to use, that offer 2FA, but restrict it to SMS or email delivery. It's purely my experience that the most important services I use (banking, investment, utilities) are commonly the ones that don't offer the ability to use an app for 2FA.
Simple Google search with cited sources, bro
https://2fa.directory/us/#banking
What do you expect of me, to audit your accounts? Are you an invalid?
Bro, I literally don't even understand your malfunction, lol. I don't at this point even know what I said you think is so wild. Lots of really important businesses and services still only allow for for SMS or email OTP delivery. If you find that for the most part that sentiment doesn't apply to you because your day to day account spread differs, more power to you.
The problem is he doesn't know what "SMS" or "OTP" means.
There seems to be a trend with certain people of always asking to "cite your sources" on every goddamn thing. Then when you refuse, they'll trot out "extraordinary claims require extraordinary evidence", and your only claim is that you bought a sandwich yesterday.
Worst way to "win" an Internet fight.
You're either playing a fool to try to rustle my jimmies, or you genuinely have exceeded your FRESHEST IF USED BY date. It bores me, so I'm just going to block you.
Nah, his responses are fine. The real problem here is just that you lack reading comprehension skills and are being a jerk for no reason.
It's funny how you don't realize that you're describing yourself to everyone else while talking with someone who is clearly much more inform that you could ever hope to be.
You don't need to go agro over someone's anecdotal comment. Makes you look like an unhinged idiot.
Not really, just tired of seeing ignorant comments posted by unhinged idiots who don't know what they're talking about in regards to a field I'm rather knowledgeable in.
In the end, I don't care what you think because you're wrong and very obviously uninformed, and just lashing out at people smarter than you who aren't willing to spoon-feed you information you could easily Google based on, again, a comment that was explicitly anecdotal.
If you had put forth even a modicum of your own effort instead of acting unhinged, you would have seen that this is a common complaint about financial institutions. But keep going off on uneducated and uninformed rants, makes you look suuuuuuuper smart.
No, being right makes me right, and here's me continuing to spoon-feed the ignorant and lazy. Look through that list and tell me that most institutions listed support TOTP. I won't wait, because you can't.
Sorry my first pick off google didn't meet the high expectations you have for data you're too lazy to even try to search for.
When you see "cite your sources" shit like this, please just block the user instead of arguing with them. So tired of these pricks. A person like this has no interest in seeing your sources, they just want to argue with anyone about anything.