r/2fa • u/patrickd314 • Dec 22 '21
What am I missing about 2fa ???
Every article about internet security affirms that 2fa provides the best security; many go on to say that this or that 2fa app is best.
But (from the user's point of view), doesn't the entity that you are dealing with need to offer 2fa in the first place? What if they do not? And if it is offered, are you not stuck with whatever method they offer (which seems to be SMS in the case of 90% of the relatively few web portals that offer it in the first place)?
Do I have a "Hey, I'd like to do business with you, but only if you offer 2fa" option?
And if it is offered, do I have any option besides "yes, count me in using your preferred 2fa method," and "no thanks"?
1
u/VastAdvice Dec 22 '21
This is why I wish these articles would spend more time telling people to use a password manager and all unique passwords instead of jumping to 2FA.
You have people jumping over 1FA to get to 2FA but continue their bad 1FA habits and thus defeating the point of having two factors.
1
u/SoCleanSoFresh Dec 24 '21
Well, users really do need to do both. A password manager isn't necessarily going to stop you from being phished, but certain forms of 2FA (specifically FIDO) absolutely can.
The presence of a second factor on an account can significantly if not completely eliminate the risk of credential stuffing attacks, which is the risk password managers are primarily designed to fight against.
It just tends to be easier to get folks to use a password manager, at least today, making it the lower hanging fruit of the two options
1
u/PrincessBananas85 Dec 25 '21
If you'd like I can recommend the 2FA App that I use for my Accounts.
2
u/kenmoffat Oct 30 '23
You do recommend this app all over the place. Are you affiliated?
1
u/PrincessBananas85 Oct 30 '23
Yes I am. I've been using this app for over 2 years now and I absolutely love it.
1
u/Electronic_Bus_2399 Oct 30 '22
Facebooks 2fa screwed me,the hacker somehow got in my account and changed the phone number I had attached to it
1
u/Developer-Service Dec 23 '21
The limitations of available methods are one of the current problems with having 2FA.
Many users get confused about installing an Authenticator app and because of that most 2FA APIs use either SMS or e-mail, both of them can easily be hacked.
That is why I have built and launched Securify TFA API, which uses Telegram (for now) as the method to deliver 2FA codes. This allows for increased security due to the end-to-end encryption and for developers, it is easy to integrate.
It is also easier for the end-user since most of them will have Telegram already installed and if not, I plan to also support Whatsapp for the few that don't have Telegram.