As someone who has had to walk the "I don't do computers" public through basic things over the phone, I can confirm that yes, a lot of people are way too lazy to learn anything new. They will instead call the support folks and blast some poor person just trying to deal with their day. Call center volume goes up anytime any barrier is added. Agreed though, SMS OTP is constantly becoming less effective. Email OTP is somewhat pointless.
Can you explain what you mean when you say email OTP is somewhat pointless?
Email is commonly compromised. It's an easy target for bad actors executing a takeover.
SMS also isn't that hard to compromise either. I can at least put email behind real 2FA, so they'd have to somehow intercept the email to break email 2FA. I can't do that with SMS, I'm at the mercy of carriers, who obviously don't care.
The email protocol, SMTP, was originally not designed with encrypting content in mind. Encryption was added years later, but as an option that is negotiated between mail servers.
While large email providers like Gmail, outlook, etc. likely all support encryption as best as they can, all it takes is one misconfigured server, etc. to cause emails to be sent in clear text at least part of the way from location to another.
It’s largely for that reason why a lot of people & organizations don’t trust email to be secure unless you use mail clients that encrypt and decrypt mail at both ends. But that’s a PITA to set up properly and manage.
If your email is sent entirely within an ecosystem like Gmail then it’s likely encrypted the entire time. But as soon as it passes outside of Gmail to another organization there’s no guarantee it’s still secure. These days it probably is, as virtually every reputable internet provider & company is going to take the issue seriously, but there’s still the history of SMTP not being encrypted that haunts those in the security fields.
Because Two-Factor Authentication is generally supposed to be under the principle of "Something you have and something you know", the password being the "know", and using a TOTP on an app via your phone would be the "have" (the phone).
I suppose if your email is restricted to the something you have/know it's a bit better, and certainly better than nothing - but not by much.
Alternatively, if your e-mail provider does offer a more secure 2FA solution, then sending a temporary code to your e-mail address would be a valid 2FA method by proxy. So it's not entirely a bad idea. (Although I've yet to see an e-mail provider that enforces 2-factor)
Protonmail. I dont have a backup email registered for recovery so if i loose my password and 2fa im totally fucked
Same, which is why I use a password manager and periodically take encrypted backups. The average person isn't going to do that, but I like having the option to use email 2FA instead of SMS, since I can make email 2FA pretty secure, but I can't do that for SMS.
Here's one that annoyed me this week. Juniper - the enterprise router people - require you to have an account to do their training. That's a web account that won't let you use more than 20 chars in your password, and won't let you paste a password.
Not 2fa, I'll grant you, but it's from the same bucket of dumb insecure shit that you're talking about.
The fields where you can’t paste a password or any other types of data like credit card info absolutely kill me. It’s doing the exact opposite of adding any level of security and it’s just infuriating.
My favorite recently is my company has TOTP 2FA but you can’t paste the 6 digits. You have to type in one digit at a time, each being its own box. Paste fails in every browser I’ve tried. It’s just a shitty user interface.
A bunch of companies seem to be implementing that version (not being able to paste the 6 digits). It's just asinine and makes me think less of any product / company using that style.
I hate all of these things so much. Like somehow my clipboard (which any halfway decent password manager either doesn't use, or scrubs clean after use) is the weak link in the security chain.
I'll go one better to @digdilem@lemmy.ml's example: I once created an account on a "security" vendor's website (quoted, because they acquired security products, rather than developing them) that limited passwords to 12 characters. They didn't tell you - they just shortened it before (presumably) storing the hash.
Fun and fucking games trying to logon each time, when your password manager has stored the random 16 char password you thought you were setting.
Passwords with such low char limits drive me nuts. I've been using passphrases because they can be more secure and easy to remember. I hate when there isn't enough space in the field for my pw. Just... Why??
ThisismyJuniperpass!
Yeah, they just want your phone number.
It's against our company policy to let users do 2FA over SMS. Only secure options are allowed.
Yeah, this is something many people seem to not understand.
SMS is not secure. The best option is something with FIDO2 or similar.
TOTP is fine. The point is that the OTP shouldn't be sent to you. It should be generated on both sides independently.
Just another example of capitalism making us all less safe.
Because our requirements come from a different business unit that has no understanding of their task, only a checklist of features that need to be implemented. "2FA" is one of those things, and we're tasked to take the easiest route possible.
TOTP is by far the easiest to implement.
Do you know how hard it is to implement TOTP? It took me two hours to implement it in my email service. You can't expect these multimillion dollar corporations to pay an engineer for two whole hours of work to implement a tested and proven standard.
I even found the commit.
https://github.com/sciactive/nymphjs/commit/cc9f8edb183271fa7f51e4b182b876efb8fa0f8d
Literally half the code was just the UI to set it up. And half of that was just links to various authenticator apps.
Simple answer. Our users complained about downloading an app to login to the app they just downloaded.
Users don’t care. They don’t want to download yet another app just to login. They want to use what they already have, like sms or email.
you only need one totp app.... people baffle me.
Most people simply don't get the point. They don't understand, let alone care about, digital privacy and security.
Anecdotal evidence: I have a short Gmail address (think billg@gmail.com), and a lot of smartasses use it to subscribe to everything, mostly as a throwaway but also on e-commerce sites, fintech bullshit with access to their bank accounts, ...
Once I got curious and reset the password, logged in and the moron had already filled in all his personal info, including his credit card. Another time I sent an SMS to the guy asking him to stop, he replied "it's my address, my nephew set it up for me, I guess we just have the same one".
These guys would never take 10 minutes to set up a 2FA app.
Similar happened to me. I've had a Gmail since the beta days and a fairly common name. I get sensitive documents sent to me, random order confirmation, even a flight confirmation that I signed into to try to find his phone number so I could text him. I'll admit I wanted so badly to cancel his flight. But I didn't. Texted him and told him he needs to reset his pwd. Just so careless.
people are even dumber than I realized holy shit. I knew people weren't willing to go far for security measures but this is actually much worse than I would have guessed.
laziness, ignorance, or privilege? I'm unsure which of the three causes this. I find it hard to believe it's ignorance because online scams and hacks are very well known and I've always hated "laziness" as a concept.
Unless you get a fidelity account. Then you need one totp app for all your other accounts and symmantec VIP proprietary shit for fidelity. Text book example of how not to implement 2fa
You can actually import the Symantec key into your TOTP of choice, it just takes some extra effort. Or you can just buy a TOTP hardware key, which is what I ended up doing (throw it in the keychain and I'm set).
I did do this. Took me forever cause there were no directions for how to do it on windows. I figured it out eventually. I'm also kinda worried whoever created it could see my totp secret key.
You can use hardware keys with fidelity? Like yubico?
No, there's a Symentec OTP fob that just generates tokens when you push a button. So something like this (I bought this one).
You'll need to replace it when the battery dies, but I like that it's not tied to my phone like the Symantec app is.
Oh. No thank you. I'm trying to stay away from symmantec.
Then at least make it an option. Just because someone's grandma doesn't want to use TOTP or any other reasonable 2FA doesn't mean nobody else does.
We do. Our users can configure sms email or totp.
Funny you mention grandmas. Our user base is highly educated and the majority fall in the 30-50 year old range.
I think it’s because TOTP requires some sort of initial token sync that is more complicated than entering a telephone number. There’s also no need to have people backup codes etc. To use Authy for example I need to photograph a QR code and have a smart phone.
Text message as a solution works on older non-smart phones so it’s possibly the “most widely accessible” solution.
From a backend perspective as well it’s just an API text $random to $phone.
Some companies main users that they want to protect are customers who consider security to be having one shared password written on the noticeboard in the office. Sadly, sms is just an easier sell to a lot of users, and even getting them to do that can be a nightmare.
As for why proper TOTP isn't supported as well... the cynic in me gives you the answer "the auditor required we implement 2fa, we have implemented sms 2fa, now go implement shiny feature x instead of wasting time" is probably a common corporate response.
I understand why people want 2FA, but I'm just not that worried about it and wish it was a choice. I am so fucking tired of pulling my phone out every single time I want to use certain applications on my computer. I don't care if these accounts get hacked, frankly, I have no money invested in them, so let me just choose to be risky for convenience sake.
Support. Explaining what OTP is to my mother would be impossible. Getting her to download an app-even harder. Companies (like mine) have to develop for the lowest common denominator. Email, sms, voice call, snail mail. That’s all we have.
We sent a letter to your address. Please type in the six digit code, which will expire in 8 weeks. If you didn't receive it after 6 weeks you can opt to send another code.
You joke, but I distinctly remember doing this about 10 years ago for a local auction website.
Mobile apps should be fairly obvious. It’s drives use of their application which is something they want. For most everything else, everyone* already has a phone and can do SMS, though it’s being proven to be more insecure.
Both of those options meet their needs, the needs of the customer are secondary.
Steam is using their own implementation that is also used for getting push notifications when selling an item on their kind of marketplace.
I don't use that feature, so having a standard 2FA would be nice as I could back it up like all the others..
Steam’s 2FA is just a different TOTP algorithm, it’s just a pain to extract it. However, once you do, there are TOTP apps that support it - Bitwarden (with premium) and Yubikey Authenticator.
Here’s a guide - note that as far as I can tell this site is not owned by Yubico but is just a random person who put up some Yubikey guides. However I did something similar over a couple years ago - pretty sure I used the same tool that’s recommended - and my Steam account hasn’t been hacked yet.
So, the real reason is because they're usually not implementing it themselves, and the service they're using has an array of options, and they went for the most "user friendly" approaches.
Registering an authenticator or typing numbers is viewed as hard by a lot of people, so SMS or an push notification are viewed as the easy route.
Mobile apps can suck a fart. I hate installing apps when the browser works perfectly fine.
SMS is way less secure but it is convenient for the masses to get your grandma easily using 2FA without any apps or more complex setup. It also doesn't require internet like an app would.
I personally use Fido2/uauth > TOTP > Email > SMS.
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed