News for hackers. Stuff that matters.
Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by fenmaz on Wednesday May 25, 2022 @07:26PM (#31512208)
Steam is another big one. They require you to use the Steam mobile app and it's the only way to do 2FA - no QR code. I've since dropped 2FA for Steam altogether.
Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by boston_clone on Wednesday May 25, 2022 @07:38PM (#31512313)
This seems to have changed; you're able to use e-mail MFA (and is what I use for my account).

Let's just hope they don't use _that_ for marketing purposes! ;)

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by cmeacham98 on Wednesday May 25, 2022 @07:49PM (#31512414)
Actually, that option has existed forever, since even before the app-based MFA.

However, if you use the "less secure" email MFA then steam places limits on your account that don't exist with the app MFA, like a forced delay on executing trades.

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by ThatPlayer on Wednesday May 25, 2022 @08:02PM (#31512532)
The Steam 2FA generation has been reverse engineered and you can use it in some password managers. Hardest part is extracting the secret

https://bitwarden.com/help/authenticator-keys/#steam-guard-t...

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by efreak on Wednesday May 25, 2022 @11:22PM (#31514067)
"upgrade" steam to version 2.1.4 or older and you can use adb backup. Android backup extractor can convert the backup to a standard tar file.
Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by efreak on Wednesday May 25, 2022 @11:19PM (#31514032)
If you've got the steam mobile app for Android for 2fa and want to move to a different app that supports steam 2fa (aegis, winauth, etc), use steam auth on multiple devices, or simply move to a new device without a temporary trade block, version 2.1.4 of the steam app will allow you to perform adb backups; Android backup extractor will allow you to convert the backup to a standard tar file to extract the secrets if you want to.