My service came back around 1:30PM in Connecticut. Data and calls are working fine. I requested a 2FA code at 2:30 from a service that only offers SMS. An hour and a half later, I still haven't gotten it.

This really shouldn't be the only way to verify its you if its going to prompt you every single time.

Tell that to $8 trillion Schwab and $12 trillion Fidelity.

If you are their direct customer you should just keep emailing support as much as possible.

Schwab support accidentally broke my account so that it sends 2FA verifications over email and I couldn't be happier.

(Well I could be happier if they supports TOTP, but I'm not holding my breath)

Well ... let's be honest: SMS 2FA shouldn't be a thing.

TOTP or stronger, please.

TOTP or SMS, it's just another text password you're entering in that's fully phishable.

TOTP just "feels" more secure.

SMS 2FA is a code that you're entering from a phone number. The "risk" is that your phone number can be ported without your permission, and then someone else can get the code.

TOTP is more secure because it isn't tied to a phone number. You're right that it's still phishable but that's not the point.

In both cases, the primary benefit to the general population is to have a rotating credential that, if one website is hacked, is useless on another website.

TOTP is more secure in that you can't be simjacked by someone impersonating you in the cell phone store.

That's assuming your attacker already has your password, or the service allows SMS password reset. (thus negating the second factor. Essentially SMS becomes the only factor.)

No, TOTP is far more secure because it has no dependence on a third-party who can mess up in many ways (Denial of service like in this case by being unavailable, Impersonation by allowing SIM swaps or intercepting messages directly).

You fully control how to store the TOTP seed and how you compute the value, so it is far more secure.

Yes, it can be phished if you fall for that, but it removes several attack vectors.

> Yes, it can be phished if you fall for that, but it removes several attack vectors.

How was the first factor (the password) compromised?

Assuming the user is using site-unique passwords, in 99% of cases where an attacker obtains a functional password they can get at least one TOTP code or the seed in the same manner. (ie, if I can steal your password DB, odds are pretty good for me stealing your TOTP seed DB as well.)

The outcome of a single successful authentication is a longer-lived session cookie. Once an attacker has that they can reset your creds (usually just requiring re-entering the password) and the account is theirs.

IMO, the only 2nd factor that matters are those that mutually authenticate like PassKeys / FIDO keys.

> You fully control how to store the TOTP seed

Sorta. The seed still needs to be issued to you in some way.

Isn't that what passkeys are suppose to be? Better and stronger than passwords with TOTP?

> TOTP or stronger, please

One of the biggest weaknesses with TOTP apps I've tried using is that you have to remember to transfer them to a new phone before you get rid of your old phone. I once got locked out of a domain registrar because I set up TOTP on an old phone many years back. That was long gone by the time I wanted to do something with my domain.

TOTP is fine, but always give me recovery codes I can print and out and keep with my other important documents. Too many services don't do that.

SMS 2FA and TOTP aren't mutually exclusive are they?

TOTP -> Time-based One Time Password SMS -> Delivery mechanism.

You can deliver TOTP over SMS.

Obviously, SMS shouldn't be used, but I was under the impression that the code generation mechanism and the code generation algorithms are completely disparate concepts.

Not sure I'm understanding you, but TOTP isn't delivered. It's generated locally/offline, based on the time and a private key that was set up when you first turned on TOTP 2FA.