This is something I am seeing more and more of. As companies start to either offer or require 2FA for accounts, they don’t follow the common standards or even offer any sort of options. One thing that drives me nuts is when they don’t offer TOTP as an option. It seems like many companies either use text messages to send a code or use some built in method of authorizing a sign in from a mobile device app.
What are your thoughts on why they want to take the time to maintain this extra feature in an app when you could have just implemented a TOTP method that probably can be imported as an existing library with much less effort?
Are they assuming that people are too dumb to understand TOTP? Are they wanting phone numbers from people? Is it to force people to install their apps?
*edit: I also really want to know what not at least give people the option to choose something like TOTP. They can still offer mobile app verification, SMS, email, carrier pigeon, etc for other options but at least give the user a choice of something besides an insecure method like SMS.
You must log in or register to comment.
As someone who has had to walk the “I don’t do computers” public through basic things over the phone, I can confirm that yes, a lot of people are way too lazy to learn anything new. They will instead call the support folks and blast some poor person just trying to deal with their day. Call center volume goes up anytime any barrier is added. Agreed though, SMS OTP is constantly becoming less effective. Email OTP is somewhat pointless.
Can you explain what you mean when you say email OTP is somewhat pointless?
Email is commonly compromised. It’s an easy target for bad actors executing a takeover.
SMS also isn’t that hard to compromise either. I can at least put email behind real 2FA, so they’d have to somehow intercept the email to break email 2FA. I can’t do that with SMS, I’m at the mercy of carriers, who obviously don’t care.
The email protocol, SMTP, was originally not designed with encrypting content in mind. Encryption was added years later, but as an option that is negotiated between mail servers.
While large email providers like Gmail, outlook, etc. likely all support encryption as best as they can, all it takes is one misconfigured server, etc. to cause emails to be sent in clear text at least part of the way from location to another.
It’s largely for that reason why a lot of people & organizations don’t trust email to be secure unless you use mail clients that encrypt and decrypt mail at both ends. But that’s a PITA to set up properly and manage.
If your email is sent entirely within an ecosystem like Gmail then it’s likely encrypted the entire time. But as soon as it passes outside of Gmail to another organization there’s no guarantee it’s still secure. These days it probably is, as virtually every reputable internet provider & company is going to take the issue seriously, but there’s still the history of SMTP not being encrypted that haunts those in the security fields.
SMS has the same problem though. It’s only marginally safer because the tools to hijack a cellular session are a bit more complicated to use, but they are widely available and you can find plenty of instructions online on how to use maybe $3k worth of equipment to spoof a GSM base station and force a target device onto it. Hell, in some cases you don’t even have to force the target device onto your rogue ENB - you can just jam the phone and hijack the number through your own SIP gateway if you get the timing right.
Because Two-Factor Authentication is generally supposed to be under the principle of “Something you have and something you know”, the password being the “know”, and using a TOTP on an app via your phone would be the “have” (the phone).
I suppose if your email is restricted to the something you have/know it’s a bit better, and certainly better than nothing - but not by much.
Alternatively, if your e-mail provider does offer a more secure 2FA solution, then sending a temporary code to your e-mail address would be a valid 2FA method by proxy. So it’s not entirely a bad idea. (Although I’ve yet to see an e-mail provider that enforces 2-factor)
Protonmail. I dont have a backup email registered for recovery so if i loose my password and 2fa im totally fucked
Same, which is why I use a password manager and periodically take encrypted backups. The average person isn’t going to do that, but I like having the option to use email 2FA instead of SMS, since I can make email 2FA pretty secure, but I can’t do that for SMS.
Here’s one that annoyed me this week. Juniper - the enterprise router people - require you to have an account to do their training. That’s a web account that won’t let you use more than 20 chars in your password, and won’t let you paste a password.
Not 2fa, I’ll grant you, but it’s from the same bucket of dumb insecure shit that you’re talking about.
The fields where you can’t paste a password or any other types of data like credit card info absolutely kill me. It’s doing the exact opposite of adding any level of security and it’s just infuriating.
My favorite recently is my company has TOTP 2FA but you can’t paste the 6 digits. You have to type in one digit at a time, each being its own box. Paste fails in every browser I’ve tried. It’s just a shitty user interface.
A bunch of companies seem to be implementing that version (not being able to paste the 6 digits). It’s just asinine and makes me think less of any product / company using that style.
I hate all of these things so much. Like somehow my clipboard (which any halfway decent password manager either doesn’t use, or scrubs clean after use) is the weak link in the security chain.
I’ll go one better to @[email protected]’s example: I once created an account on a “security” vendor’s website (quoted, because they acquired security products, rather than developing them) that limited passwords to 12 characters. They didn’t tell you - they just shortened it before (presumably) storing the hash.
Fun and fucking games trying to logon each time, when your password manager has stored the random 16 char password you thought you were setting.
Passwords with such low char limits drive me nuts. I’ve been using passphrases because they can be more secure and easy to remember. I hate when there isn’t enough space in the field for my pw. Just… Why??
ThisismyJuniperpass!
Yeah, they just want your phone number.
It’s against our company policy to let users do 2FA over SMS. Only secure options are allowed.
Yeah, this is something many people seem to not understand.
SMS is not secure. The best option is something with FIDO2 or similar.
TOTP is fine. The point is that the OTP shouldn’t be sent to you. It should be generated on both sides independently.
Yes Facebook is using your 2FA phone number to target you with ads (from 2018, back when phones were still sometimes used for 2FA)
Just another example of capitalism making us all less safe.
Because our requirements come from a different business unit that has no understanding of their task, only a checklist of features that need to be implemented. “2FA” is one of those things, and we’re tasked to take the easiest route possible.
TOTP is by far the easiest to implement.
Do you know how hard it is to implement TOTP? It took me two hours to implement it in my email service. You can’t expect these multimillion dollar corporations to pay an engineer for two whole hours of work to implement a tested and proven standard.
I even found the commit.
https://github.com/sciactive/nymphjs/commit/cc9f8edb183271fa7f51e4b182b876efb8fa0f8d
Literally half the code was just the UI to set it up. And half of that was just links to various authenticator apps.
Simple answer. Our users complained about downloading an app to login to the app they just downloaded.
Users don’t care. They don’t want to download yet another app just to login. They want to use what they already have, like sms or email.
you only need one totp app… people baffle me.
Most people simply don’t get the point. They don’t understand, let alone care about, digital privacy and security.
Anecdotal evidence: I have a short Gmail address (think [email protected]), and a lot of smartasses use it to subscribe to everything, mostly as a throwaway but also on e-commerce sites, fintech bullshit with access to their bank accounts, …
Once I got curious and reset the password, logged in and the moron had already filled in all his personal info, including his credit card. Another time I sent an SMS to the guy asking him to stop, he replied “it’s my address, my nephew set it up for me, I guess we just have the same one”.
These guys would never take 10 minutes to set up a 2FA app.
Similar happened to me. I’ve had a Gmail since the beta days and a fairly common name. I get sensitive documents sent to me, random order confirmation, even a flight confirmation that I signed into to try to find his phone number so I could text him. I’ll admit I wanted so badly to cancel his flight. But I didn’t. Texted him and told him he needs to reset his pwd. Just so careless.
people are even dumber than I realized holy shit. I knew people weren’t willing to go far for security measures but this is actually much worse than I would have guessed.
laziness, ignorance, or privilege? I’m unsure which of the three causes this. I find it hard to believe it’s ignorance because online scams and hacks are very well known and I’ve always hated “laziness” as a concept.
Unless you get a fidelity account. Then you need one totp app for all your other accounts and symmantec VIP proprietary shit for fidelity. Text book example of how not to implement 2fa
You can actually import the Symantec key into your TOTP of choice, it just takes some extra effort. Or you can just buy a TOTP hardware key, which is what I ended up doing (throw it in the keychain and I’m set).
I did do this. Took me forever cause there were no directions for how to do it on windows. I figured it out eventually. I’m also kinda worried whoever created it could see my totp secret key.
You can use hardware keys with fidelity? Like yubico?
No, there’s a Symentec OTP fob that just generates tokens when you push a button. So something like this (I bought this one).
You’ll need to replace it when the battery dies, but I like that it’s not tied to my phone like the Symantec app is.
Oh. No thank you. I’m trying to stay away from symmantec.
And you should be using a password manager anyway, which can generate the token. Granted, it’s probably bad practice, since it defeats the two factor aspect.
Perfect security gets in the way of improved security. The best practice is a middle ground of security and convience. At least it depends on the threat level anyways.
Then at least make it an option. Just because someone’s grandma doesn’t want to use TOTP or any other reasonable 2FA doesn’t mean nobody else does.
We do. Our users can configure sms email or totp.
Funny you mention grandmas. Our user base is highly educated and the majority fall in the 30-50 year old range.
Sadly that’s true. I’m in that range and most of my friends use the same password for almost everything. Also nobody does backups.
Damnit, trying to convince people to use a password manager at all is like pulling teeth…
Stop setting every service you use to the same hunter2 password Frank! You get “hacked” because you can’t remember anything more complex, so use a fucking password manager already you Putz.
I can’t answer your question but it’s particularly annoying for me because I travel a lot for work. Sending me an SMS message when I’m in the middle of Africa isn’t going to work. (In fact I found a way to make it work by enabling wifi calling with my US cell provider… but I shouldn’t have to jump through hoops to verify my identity)
I also used to run into this when flying for work I would have paid for wifi on a plane flight but my mobile device isn’t able to get their text or push notification because I only paid for my laptop to have wifi. Used to drive me crazy and then I just stopped working while on flights because of dumb policies.
That’s why you use an Authenticator app that gives you TOTP offline.
That’s exactly what this thread is about. When companies don’t provide that as an option.
If a service you use does not offer TOTP but implements their own 2FA through another method, you have no choice to use it though.
I think it’s because TOTP requires some sort of initial token sync that is more complicated than entering a telephone number. There’s also no need to have people backup codes etc. To use Authy for example I need to photograph a QR code and have a smart phone.
Text message as a solution works on older non-smart phones so it’s possibly the “most widely accessible” solution.
From a backend perspective as well it’s just an API text $random to $phone.
TOTP is much easier to implement on the backend. No API required, just generate a few codes yourself and check if the user gave you one of them (multiple codes to provide a time window).
You have to configure the users device at the start to give you your own codes back…
That’s just a secret, like a password. If you can save their password, you can save their TOTP secret. For the user, they just scan a QR code with their app. They don’t even have to type the code in.
Support. Explaining what OTP is to my mother would be impossible. Getting her to download an app-even harder. Companies (like mine) have to develop for the lowest common denominator. Email, sms, voice call, snail mail. That’s all we have.
We sent a letter to your address. Please type in the six digit code, which will expire in 8 weeks. If you didn’t receive it after 6 weeks you can opt to send another code.
You joke, but I distinctly remember doing this about 10 years ago for a local auction website.
But, like, why not have SMS and TOTP support? TOTP is trivially easy to implement.
Again, support.
If the problem is that someone doesn’t know what TOTP is, then just hide the setup behind a link that says “Use TOTP instead of SMS”. Problem solved. Everyone who knows what it is can use it, and the people who don’t won’t click it.
If it’s hidden, then no one would use it and my development time is better spent on things that matter.
(I don’t actually disagree with you, I like TOTP personally)
I don’t mean actually hidden, I mean an option behind a link. Of course people would use it. I would, you would, and OP would. That’s 100% of the people in this conversation.
As long as I can say “you’re on your own” to every one of those 100%
Some companies main users that they want to protect are customers who consider security to be having one shared password written on the noticeboard in the office. Sadly, sms is just an easier sell to a lot of users, and even getting them to do that can be a nightmare.
As for why proper TOTP isn’t supported as well… the cynic in me gives you the answer “the auditor required we implement 2fa, we have implemented sms 2fa, now go implement shiny feature x instead of wasting time” is probably a common corporate response.
Mobile apps should be fairly obvious. It’s drives use of their application which is something they want. For most everything else, everyone* already has a phone and can do SMS, though it’s being proven to be more insecure.
Both of those options meet their needs, the needs of the customer are secondary.
I understand why people want 2FA, but I’m just not that worried about it and wish it was a choice. I am so fucking tired of pulling my phone out every single time I want to use certain applications on my computer. I don’t care if these accounts get hacked, frankly, I have no money invested in them, so let me just choose to be risky for convenience sake.
Steam is using their own implementation that is also used for getting push notifications when selling an item on their kind of marketplace.
I don’t use that feature, so having a standard 2FA would be nice as I could back it up like all the others…
Steam’s 2FA is just a different TOTP algorithm, it’s just a pain to extract it. However, once you do, there are TOTP apps that support it - Bitwarden (with premium) and Yubikey Authenticator.
Here’s a guide - note that as far as I can tell this site is not owned by Yubico but is just a random person who put up some Yubikey guides. However I did something similar over a couple years ago - pretty sure I used the same tool that’s recommended - and my Steam account hasn’t been hacked yet.
So, the real reason is because they’re usually not implementing it themselves, and the service they’re using has an array of options, and they went for the most “user friendly” approaches.
Registering an authenticator or typing numbers is viewed as hard by a lot of people, so SMS or an push notification are viewed as the easy route.deleted by creator
Could at least offer it, I don’t consider SMS secure, and push notifications require that you have a supported mobile device.
You’re not wrong, but it can be difficult to support more than the minimum without more buy-in from a financial perspective. Things beyond SMS tend to need an enrollment process that would impact the user sign-up flow.
You can create the user and store their phone number in one step, but totp sign-up usually needs something where you can create a provisional user, and then activate their MFA to activate the user.It’s why a lot of passkey stuff has a lot of potential, since it can make it easier for the user to sign-up, which has an appeal to people who are making decisions that have to consider sales and IT concerns.
Mobile apps can suck a fart. I hate installing apps when the browser works perfectly fine.
SMS is way less secure but it is convenient for the masses to get your grandma easily using 2FA without any apps or more complex setup. It also doesn’t require internet like an app would.
I personally use Fido2/uauth > TOTP > Email > SMS.
I haven’t found a single site that I actually use that offers real FIDO2. Those that offer it fall back to SMS, which essentially means it’s just SMS 2FA.
Kind of.
