Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by devwastaken on Thursday October 11, 2018 @01:37PM
(#18195456)
Or, allow it, and inform them there's a safer method called Google authenticator. Authenticators make your logins dependent upon 3rd party software, and is only as secure as how that single source of failure is.
[ Parent
| on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by shittyadmin on Thursday October 11, 2018 @01:40PM
(#18195481)
There's many 2FA apps compatible with the TOTP and HOTP standards and they rarely, if ever require an update.
Absolutely minimal 3rd party involvement, I'd say less than most web browsers these days as there really isn't a significant attack surface for the apps.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by kaoD on Thursday October 11, 2018 @02:26PM
(#18195881)
If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive:
https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a...
https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...
https://github.com/google/google-authenticator/wiki/Key-Uri-...
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by VectorLock on Friday October 12, 2018 @01:46AM
(#18199502)
It always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by joewee on Thursday October 11, 2018 @02:29PM
(#18195905)
Many of these services, I believe google is one, still require mobile phone as a fallback option.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by nobodyshere on Thursday October 11, 2018 @04:31PM
(#18196809)
Google requires at least 2 ways of 2fa protection. You can enable a third one and disable the phone completely.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by jandrese on Thursday October 11, 2018 @07:47PM
(#18197961)
Requiring the phone number is mostly an anti-bot/spammer measure. Once they've seen your phone number you don't need to let them use it anymore.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by seppin on Thursday October 11, 2018 @02:45PM
(#18196025)
Paypal, an actual bank, still only allows SMS 2fa. It's stupid.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by Avamander on Thursday October 11, 2018 @03:05PM
(#18196173)
Wrong. TOTP is supported, although hidden.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by jdeibele on Thursday October 11, 2018 @04:55PM
(#18196959)
https://www.paypal-community.com/t5/Tips-from-Moderators/Pay...
It uses Verisign's VIP app instead of Google Authenticator (or Authy or whatever).
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by Avamander on Friday October 12, 2018 @02:36PM
(#18203639)
You can use any TOTP app.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by seppin on Thursday October 18, 2018 @12:59PM
(#18250008)
It's not hidden, it's de facto disabled for 99% of users. Fix this, Paypal.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by npunt on Thursday October 11, 2018 @05:59PM
(#18197363)
According to some threads I've read it doesn't work in all circumstances.
Personally I wouldn't risk it since it could mean risking getting locked out of your account.
Re:Listen to a SIM-Jacking, Account-Stealing Ransom
by Avamander on Friday October 12, 2018 @02:38PM
(#18203647)
I've been using it for a few years now and I haven't encountered a place where I couldn't use it. It might force you to enter the TOTP code at the end of your password though, but it works.