/tech/ - Technology★

>>1025896 (OP)

>in which cases would you refrain from using it?

When the implementation is so shit that it's not actually 2 factor authentication but rather getting access to the "2nd authentication" method allows taking over the account. AT&T had a thing where you could walk to a store and do a sim swap by saying you lost your phone and they just allowed you to take over someone elses number, for example people used this to take over popular youtube accounts for and some dude stole $23m in bitcoin by doing sim swap. On many services you are better of not linking your phone and not using this "2 factor authentication".

I like 2 factor authentication as a concept but most implementations are retarded to the point where they make things worse or are just snake oil such as passing a security code for bank transaction through the same browser you just used to login with your passwords, few lines of javascript displaying false transaction info can defeat this kind of snakeoil.

Not all implementations suck though, eg. storing bitcoin wallets or private keys on separate device is cool and good.

>In what would your second factor of choice be?

A second device which displays the transaction data with some parts redacted and asks to confirm transactions/login but doesn't allow taking over the account. A unique token for the verification device should be registered instead of having to enter/store password on the device. This could be just smartphone with special app or any device really.

Have been using a Yubikey for some time now, and it's a definite step up from (((google authenticator))). They are not cheap but the peace of mind is worth it. There are probably other models but Yubikey is the one that the big corporations with lots of sensitive data use most of the time from what I have read. You should honestly buy 2, and program the second as a backup in case anything were to happen to the first. And if you do, make sure they're the same model, I didn't and ended up with one mini and one regular, and while I can use the mini for my main password manager, it won't work for sites that don't use the touch/tap. Their authenticator app works for anything that doesn't support U2F.

>>1026004

Oh and the authenticator app is protected by the key itself, so it won't even start if you don't have the key plugged in and know the password. Pretty neat.

2FA is a meme at best botnet at worst

>In what would your second factor of choice be?

Not a fan of having to plug in the key every time to authenticate. I've grown vary of arbitrary physical contact, especially if I have to use a computer that belongs to someone else. So I like the idea of two factor authentication apps (TOTP) stored on a seperate, offline device that is dedicated to handling this kind of data. It should have a keyboard I can input the secret rather than a camera to read the qr code. An airgapped laptop with Keepass2 is the closest thing to I'm describing here but it is not ideally portable. An offline smartphone with Google/LastPass/Microsoft/Authy Authenticator could also work but then the unremovable wireless chips pose a security threat.

>>1026070

this. a secure password is enough but normies will never do that so they waste money on these things