Two Factor Auth List

Re:Two Factor Auth List by scrollaway on Thursday November 30, 2017 @12:58PM (#15817860)

My Hearthstone account has better security than my Paypal account.

Here are some fun websites that do not support decent TOTP 2FA or U2F:

    - Ebay
    - Paypal
    - Most banking websites apparently because regulations *shrugs*
    - Twitter. The thing the POTUS uses to communicate.

And here is just some utter nonsense:

- Facebook supports TOTP 2fa... but you need a phone number linked to the account

- Wikipedia has TOTP 2fa... but only for sysadmins

- Steam is one of the rare oddballs in the gaming space, with an idiotic email-based 2fa system, which by the way constantly gets hit by massive delays.

[ Parent | on HN ]

Re:Two Factor Auth List by ianburrell on Thursday November 30, 2017 @01:24PM (#15818135)

Steam now has Steam Guard Mobile Authenticator which does 2FA codes on the Steam mobile app. It looks like it uses TOTP but with different encoding and no way to use other app. It is now required for trades and market sales, and they need to be confirmed in mobile app.

[ Parent | on HN ]

Re:Two Factor Auth List by jlgaddis on Thursday November 30, 2017 @01:34PM (#15818235)

PayPal does support (at least some) 2FA methods as my first YubiKey (~6 years ago?) was a "YubiKey VIP" that worked with PayPal (6-digit codes). There was also a "Symantec VIP" mobile app that you could use (very similar to Google Authenticator) instead.

PayPal also had their own security device you could get. I think it cost $5. Not sure if it's still available.

[ Parent | on HN ]

Re:Two Factor Auth List by tonyztan on Thursday November 30, 2017 @01:02PM (#15817896)

For Wikipedia, you can currently get 2FA by requesting to be added to the oauth-testing group. But yeah, it should really be enabled for everyone.

https://en.wikipedia.org/wiki/Wikipedia_talk:Simple_2FA#Why_...

[ Parent | on HN ]

Re:Two Factor Auth List by evgen on Thursday November 30, 2017 @01:33PM (#15818222)

You only need a phone number linked to the FB account during setup. Once 2fa is turned on you can unlink the phone number.

[ Parent | on HN ]

Re:Two Factor Auth List by jlgaddis on Thursday November 30, 2017 @01:39PM (#15818277)

A lot of sites are like this but they miss the point... which is that I don't want to give them my mobile phone number in the first place.

I might, if I could reasonably trust that they really do delete it, but I think experience shows that we can't completely trust most companies nowadays.

[ Parent | on HN ]

Re:Two Factor Auth List by technofiend on Thursday November 30, 2017 @04:57PM (#15819953)

[ Parent | on HN ]

Re:Two Factor Auth List by jazoom on Thursday November 30, 2017 @03:50PM (#15819376)

Even though I've set up 2FA with Facebook, every time they ask for it they also send me the code in an SMS.

[ Parent | on HN ]

Re:Two Factor Auth List by kroltan on Thursday November 30, 2017 @01:17PM (#15818063)

Steam also has software tokens if you use the Steam mobile app.

Blizzard also supports 2FA, but other than those, most gaming services don't support it indeed.

[ Parent | on HN ]

Re:Two Factor Auth List by scrollaway on Thursday November 30, 2017 @03:57PM (#15819460)

Blizzard's 2FA is TOTP 8-digits! Here's a library/cli tool that can create tokens:

https://github.com/jleclanche/python-bna

You can use it to export the seed or a QR of it, if you want to stuff your Blizzard TOTP into andOTP or something.

[ Parent | on HN ]

Re:Two Factor Auth List by exabrial on Thursday November 30, 2017 @07:01PM (#15820803)

Fb you can have u2f and totp and disable the silly "2 factors sms" thing.

[ Parent | on HN ]