This is something I am seeing more and more of. As companies start to either offer or require 2FA for accounts, they don’t follow the common standards or even offer any sort of options. One thing that drives me nuts is when they don’t offer TOTP as an option. It seems like many companies either use text messages to send a code or use some built in method of authorizing a sign in from a mobile device app.
What are your thoughts on why they want to take the time to maintain this extra feature in an app when you could have just implemented a TOTP method that probably can be imported as an existing library with much less effort?
Are they assuming that people are too dumb to understand TOTP? Are they wanting phone numbers from people? Is it to force people to install their apps?
*edit: I also really want to know what not at least give people the option to choose something like TOTP. They can still offer mobile app verification, SMS, email, carrier pigeon, etc for other options but at least give the user a choice of something besides an insecure method like SMS.
You must log in or register to comment.
As someone who has had to walk the “I don’t do computers” public through basic things over the phone, I can confirm that yes, a lot of people are way too lazy to learn anything new. They will instead call the support folks and blast some poor person just trying to deal with their day. Call center volume goes up anytime any barrier is added. Agreed though, SMS OTP is constantly becoming less effective. Email OTP is somewhat pointless.
Can you explain what you mean when you say email OTP is somewhat pointless?
Email is commonly compromised. It’s an easy target for bad actors executing a takeover.
The email protocol, SMTP, was originally not designed with encrypting content in mind. Encryption was added years later, but as an option that is negotiated between mail servers.
While large email providers like Gmail, outlook, etc. likely all support encryption as best as they can, all it takes is one misconfigured server, etc. to cause emails to be sent in clear text at least part of the way from location to another.
It’s largely for that reason why a lot of people & organizations don’t trust email to be secure unless you use mail clients that encrypt and decrypt mail at both ends. But that’s a PITA to set up properly and manage.
If your email is sent entirely within an ecosystem like Gmail then it’s likely encrypted the entire time. But as soon as it passes outside of Gmail to another organization there’s no guarantee it’s still secure. These days it probably is, as virtually every reputable internet provider & company is going to take the issue seriously, but there’s still the history of SMTP not being encrypted that haunts those in the security fields.
Because Two-Factor Authentication is generally supposed to be under the principle of “Something you have and something you know”, the password being the “know”, and using a TOTP on an app via your phone would be the “have” (the phone).
I suppose if your email is restricted to the something you have/know it’s a bit better, and certainly better than nothing - but not by much.
Alternatively, if your e-mail provider does offer a more secure 2FA solution, then sending a temporary code to your e-mail address would be a valid 2FA method by proxy. So it’s not entirely a bad idea. (Although I’ve yet to see an e-mail provider that enforces 2-factor)
Protonmail. I dont have a backup email registered for recovery so if i loose my password and 2fa im totally fucked
Here’s one that annoyed me this week. Juniper - the enterprise router people - require you to have an account to do their training. That’s a web account that won’t let you use more than 20 chars in your password, and won’t let you paste a password.
Not 2fa, I’ll grant you, but it’s from the same bucket of dumb insecure shit that you’re talking about.
The fields where you can’t paste a password or any other types of data like credit card info absolutely kill me. It’s doing the exact opposite of adding any level of security and it’s just infuriating.
My favorite recently is my company has TOTP 2FA but you can’t paste the 6 digits. You have to type in one digit at a time, each being its own box. Paste fails in every browser I’ve tried. It’s just a shitty user interface.
I hate all of these things so much. Like somehow my clipboard (which any halfway decent password manager either doesn’t use, or scrubs clean after use) is the weak link in the security chain.
I’ll go one better to @digdilem@lemmy.ml’s example: I once created an account on a “security” vendor’s website (quoted, because they acquired security products, rather than developing them) that limited passwords to 12 characters. They didn’t tell you - they just shortened it before (presumably) storing the hash.
Fun and fucking games trying to logon each time, when your password manager has stored the random 16 char password you thought you were setting.
ThisismyJuniperpass!
Yeah, they just want your phone number.
It’s against our company policy to let users do 2FA over SMS. Only secure options are allowed.
Yeah, this is something many people seem to not understand.
SMS is not secure. The best option is something with FIDO2 or similar.
TOTP is fine. The point is that the OTP shouldn’t be sent to you. It should be generated on both sides independently.
Yes Facebook is using your 2FA phone number to target you with ads (from 2018, back when phones were still sometimes used for 2FA)
Because our requirements come from a different business unit that has no understanding of their task, only a checklist of features that need to be implemented. “2FA” is one of those things, and we’re tasked to take the easiest route possible.
TOTP is by far the easiest to implement.
Do you know how hard it is to implement TOTP? It took me two hours to implement it in my email service. You can’t expect these multimillion dollar corporations to pay an engineer for two whole hours of work to implement a tested and proven standard.
I even found the commit.
https://github.com/sciactive/nymphjs/commit/cc9f8edb183271fa7f51e4b182b876efb8fa0f8d
Literally half the code was just the UI to set it up. And half of that was just links to various authenticator apps.
Simple answer. Our users complained about downloading an app to login to the app they just downloaded.
Users don’t care. They don’t want to download yet another app just to login. They want to use what they already have, like sms or email.
you only need one totp app… people baffle me.
And you should be using a password manager anyway, which can generate the token. Granted, it’s probably bad practice, since it defeats the two factor aspect.
Perfect security gets in the way of improved security. The best practice is a middle ground of security and convience. At least it depends on the threat level anyways.
Then at least make it an option. Just because someone’s grandma doesn’t want to use TOTP or any other reasonable 2FA doesn’t mean nobody else does.
We do. Our users can configure sms email or totp.
Funny you mention grandmas. Our user base is highly educated and the majority fall in the 30-50 year old range.
Sadly that’s true. I’m in that range and most of my friends use the same password for almost everything. Also nobody does backups.
Damnit, trying to convince people to use a password manager at all is like pulling teeth…
Stop setting every service you use to the same hunter2 password Frank! You get “hacked” because you can’t remember anything more complex, so use a fucking password manager already you Putz.
I can’t answer your question but it’s particularly annoying for me because I travel a lot for work. Sending me an SMS message when I’m in the middle of Africa isn’t going to work. (In fact I found a way to make it work by enabling wifi calling with my US cell provider… but I shouldn’t have to jump through hoops to verify my identity)
I also used to run into this when flying for work I would have paid for wifi on a plane flight but my mobile device isn’t able to get their text or push notification because I only paid for my laptop to have wifi. Used to drive me crazy and then I just stopped working while on flights because of dumb policies.
That’s why you use an Authenticator app that gives you TOTP offline.
That’s exactly what this thread is about. When companies don’t provide that as an option.
If a service you use does not offer TOTP but implements their own 2FA through another method, you have no choice to use it though.
I think it’s because TOTP requires some sort of initial token sync that is more complicated than entering a telephone number. There’s also no need to have people backup codes etc. To use Authy for example I need to photograph a QR code and have a smart phone.
Text message as a solution works on older non-smart phones so it’s possibly the “most widely accessible” solution.
From a backend perspective as well it’s just an API text $random to $phone.
TOTP is much easier to implement on the backend. No API required, just generate a few codes yourself and check if the user gave you one of them (multiple codes to provide a time window).
You have to configure the users device at the start to give you your own codes back…
That’s just a secret, like a password. If you can save their password, you can save their TOTP secret. For the user, they just scan a QR code with their app. They don’t even have to type the code in.
Support. Explaining what OTP is to my mother would be impossible. Getting her to download an app-even harder. Companies (like mine) have to develop for the lowest common denominator. Email, sms, voice call, snail mail. That’s all we have.
We sent a letter to your address. Please type in the six digit code, which will expire in 8 weeks. If you didn’t receive it after 6 weeks you can opt to send another code.
You joke, but I distinctly remember doing this about 10 years ago for a local auction website.
But, like, why not have SMS and TOTP support? TOTP is trivially easy to implement.
Again, support.
If the problem is that someone doesn’t know what TOTP is, then just hide the setup behind a link that says “Use TOTP instead of SMS”. Problem solved. Everyone who knows what it is can use it, and the people who don’t won’t click it.
If it’s hidden, then no one would use it and my development time is better spent on things that matter.
(I don’t actually disagree with you, I like TOTP personally)
I don’t mean actually hidden, I mean an option behind a link. Of course people would use it. I would, you would, and OP would. That’s 100% of the people in this conversation.
As long as I can say “you’re on your own” to every one of those 100%
Some companies main users that they want to protect are customers who consider security to be having one shared password written on the noticeboard in the office. Sadly, sms is just an easier sell to a lot of users, and even getting them to do that can be a nightmare.
As for why proper TOTP isn’t supported as well… the cynic in me gives you the answer “the auditor required we implement 2fa, we have implemented sms 2fa, now go implement shiny feature x instead of wasting time” is probably a common corporate response.
Mobile apps should be fairly obvious. It’s drives use of their application which is something they want. For most everything else, everyone* already has a phone and can do SMS, though it’s being proven to be more insecure.
Both of those options meet their needs, the needs of the customer are secondary.
I understand why people want 2FA, but I’m just not that worried about it and wish it was a choice. I am so fucking tired of pulling my phone out every single time I want to use certain applications on my computer. I don’t care if these accounts get hacked, frankly, I have no money invested in them, so let me just choose to be risky for convenience sake.
Steam is using their own implementation that is also used for getting push notifications when selling an item on their kind of marketplace.
I don’t use that feature, so having a standard 2FA would be nice as I could back it up like all the others…
Steam’s 2FA is just a different TOTP algorithm, it’s just a pain to extract it. However, once you do, there are TOTP apps that support it - Bitwarden (with premium) and Yubikey Authenticator.
Here’s a guide - note that as far as I can tell this site is not owned by Yubico but is just a random person who put up some Yubikey guides. However I did something similar over a couple years ago - pretty sure I used the same tool that’s recommended - and my Steam account hasn’t been hacked yet.
They just pay a vendor for it and don’t care about the things you do.
Maybe they themselves are too dumb to understand TOTP. Or incapable of being humble enough to study standards / use them or even think for a second that those might be standards. I guess the fact that most software is done by consulting companies with armies of fresh graduates doesn’t help either.
I complained to a company and they told me that SMS two factor is a security standard from Google. Clueless.
Aahahah
Hell even with Authelia I could implement it at home.
Shouldn’t be that hard.
