This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
Here's one that annoyed me this week. Juniper - the enterprise router people - require you to have an account to do their training. That's a web account that won't let you use more than 20 chars in your password, and won't let you paste a password.
Not 2fa, I'll grant you, but it's from the same bucket of dumb insecure shit that you're talking about.
The fields where you can’t paste a password or any other types of data like credit card info absolutely kill me. It’s doing the exact opposite of adding any level of security and it’s just infuriating.
My favorite recently is my company has TOTP 2FA but you can’t paste the 6 digits. You have to type in one digit at a time, each being its own box. Paste fails in every browser I’ve tried. It’s just a shitty user interface.
A bunch of companies seem to be implementing that version (not being able to paste the 6 digits). It's just asinine and makes me think less of any product / company using that style.
I hate all of these things so much. Like somehow my clipboard (which any halfway decent password manager either doesn't use, or scrubs clean after use) is the weak link in the security chain.
I'll go one better to @digdilem@lemmy.ml's example: I once created an account on a "security" vendor's website (quoted, because they acquired security products, rather than developing them) that limited passwords to 12 characters. They didn't tell you - they just shortened it before (presumably) storing the hash.
Fun and fucking games trying to logon each time, when your password manager has stored the random 16 char password you thought you were setting.
Passwords with such low char limits drive me nuts. I've been using passphrases because they can be more secure and easy to remember. I hate when there isn't enough space in the field for my pw. Just... Why??
ThisismyJuniperpass!
Yeah, they just want your phone number.
It's against our company policy to let users do 2FA over SMS. Only secure options are allowed.
Yeah, this is something many people seem to not understand.
SMS is not secure. The best option is something with FIDO2 or similar.
TOTP is fine. The point is that the OTP shouldn't be sent to you. It should be generated on both sides independently.
Yes Facebook is using your 2FA phone number to target you with ads (from 2018, back when phones were still sometimes used for 2FA)
Just another example of capitalism making us all less safe.
Because our requirements come from a different business unit that has no understanding of their task, only a checklist of features that need to be implemented. "2FA" is one of those things, and we're tasked to take the easiest route possible.
TOTP is by far the easiest to implement.
Do you know how hard it is to implement TOTP? It took me two hours to implement it in my email service. You can't expect these multimillion dollar corporations to pay an engineer for two whole hours of work to implement a tested and proven standard.
I even found the commit.
https://github.com/sciactive/nymphjs/commit/cc9f8edb183271fa7f51e4b182b876efb8fa0f8d
Literally half the code was just the UI to set it up. And half of that was just links to various authenticator apps.
Simple answer. Our users complained about downloading an app to login to the app they just downloaded.
Users don’t care. They don’t want to download yet another app just to login. They want to use what they already have, like sms or email.
you only need one totp app.... people baffle me.
Most people simply don't get the point. They don't understand, let alone care about, digital privacy and security.
Anecdotal evidence: I have a short Gmail address (think billg@gmail.com), and a lot of smartasses use it to subscribe to everything, mostly as a throwaway but also on e-commerce sites, fintech bullshit with access to their bank accounts, ...
Once I got curious and reset the password, logged in and the moron had already filled in all his personal info, including his credit card. Another time I sent an SMS to the guy asking him to stop, he replied "it's my address, my nephew set it up for me, I guess we just have the same one".
These guys would never take 10 minutes to set up a 2FA app.
Similar happened to me. I've had a Gmail since the beta days and a fairly common name. I get sensitive documents sent to me, random order confirmation, even a flight confirmation that I signed into to try to find his phone number so I could text him. I'll admit I wanted so badly to cancel his flight. But I didn't. Texted him and told him he needs to reset his pwd. Just so careless.
people are even dumber than I realized holy shit. I knew people weren't willing to go far for security measures but this is actually much worse than I would have guessed.
laziness, ignorance, or privilege? I'm unsure which of the three causes this. I find it hard to believe it's ignorance because online scams and hacks are very well known and I've always hated "laziness" as a concept.
Unless you get a fidelity account. Then you need one totp app for all your other accounts and symmantec VIP proprietary shit for fidelity. Text book example of how not to implement 2fa
You can actually import the Symantec key into your TOTP of choice, it just takes some extra effort. Or you can just buy a TOTP hardware key, which is what I ended up doing (throw it in the keychain and I'm set).
I did do this. Took me forever cause there were no directions for how to do it on windows. I figured it out eventually. I'm also kinda worried whoever created it could see my totp secret key.
You can use hardware keys with fidelity? Like yubico?
No, there's a Symentec OTP fob that just generates tokens when you push a button. So something like this (I bought this one).
You'll need to replace it when the battery dies, but I like that it's not tied to my phone like the Symantec app is.
Oh. No thank you. I'm trying to stay away from symmantec.
And you should be using a password manager anyway, which can generate the token. Granted, it's probably bad practice, since it defeats the two factor aspect.
Perfect security gets in the way of improved security. The best practice is a middle ground of security and convience. At least it depends on the threat level anyways.
Then at least make it an option. Just because someone's grandma doesn't want to use TOTP or any other reasonable 2FA doesn't mean nobody else does.
We do. Our users can configure sms email or totp.
Funny you mention grandmas. Our user base is highly educated and the majority fall in the 30-50 year old range.
I can't answer your question but it's particularly annoying for me because I travel a lot for work. Sending me an SMS message when I'm in the middle of Africa isn't going to work. (In fact I found a way to make it work by enabling wifi calling with my US cell provider.. but I shouldn't have to jump through hoops to verify my identity)
I also used to run into this when flying for work I would have paid for wifi on a plane flight but my mobile device isn't able to get their text or push notification because I only paid for my laptop to have wifi. Used to drive me crazy and then I just stopped working while on flights because of dumb policies.
I think it’s because TOTP requires some sort of initial token sync that is more complicated than entering a telephone number. There’s also no need to have people backup codes etc. To use Authy for example I need to photograph a QR code and have a smart phone.
Text message as a solution works on older non-smart phones so it’s possibly the “most widely accessible” solution.
From a backend perspective as well it’s just an API text $random to $phone.
TOTP is much easier to implement on the backend. No API required, just generate a few codes yourself and check if the user gave you one of them (multiple codes to provide a time window).
Support. Explaining what OTP is to my mother would be impossible. Getting her to download an app-even harder. Companies (like mine) have to develop for the lowest common denominator. Email, sms, voice call, snail mail. That’s all we have.
We sent a letter to your address. Please type in the six digit code, which will expire in 8 weeks. If you didn't receive it after 6 weeks you can opt to send another code.
I understand why people want 2FA, but I'm just not that worried about it and wish it was a choice. I am so fucking tired of pulling my phone out every single time I want to use certain applications on my computer. I don't care if these accounts get hacked, frankly, I have no money invested in them, so let me just choose to be risky for convenience sake.
Mobile apps should be fairly obvious. It’s drives use of their application which is something they want. For most everything else, everyone* already has a phone and can do SMS, though it’s being proven to be more insecure.
Both of those options meet their needs, the needs of the customer are secondary.
Steam is using their own implementation that is also used for getting push notifications when selling an item on their kind of marketplace.
I don't use that feature, so having a standard 2FA would be nice as I could back it up like all the others..
Steam’s 2FA is just a different TOTP algorithm, it’s just a pain to extract it. However, once you do, there are TOTP apps that support it - Bitwarden (with premium) and Yubikey Authenticator.
Here’s a guide - note that as far as I can tell this site is not owned by Yubico but is just a random person who put up some Yubikey guides. However I did something similar over a couple years ago - pretty sure I used the same tool that’s recommended - and my Steam account hasn’t been hacked yet.
So, the real reason is because they're usually not implementing it themselves, and the service they're using has an array of options, and they went for the most "user friendly" approaches.
Registering an authenticator or typing numbers is viewed as hard by a lot of people, so SMS or an push notification are viewed as the easy route.
Mobile apps can suck a fart. I hate installing apps when the browser works perfectly fine.
SMS is way less secure but it is convenient for the masses to get your grandma easily using 2FA without any apps or more complex setup. It also doesn't require internet like an app would.
I personally use Fido2/uauth > TOTP > Email > SMS.
Maybe they themselves are too dumb to understand TOTP. Or incapable of being humble enough to study standards / use them or even think for a second that those might be standards. I guess the fact that most software is done by consulting companies with armies of fresh graduates doesn't help either.
I complained to a company and they told me that SMS two factor is a security standard from Google. Clueless.
I've 14 items in Authy, and basically never used SMS as 2FA. Only to validate my identity on first signup. The only time SMS was used as 2FA for me was by the company I had an internship in programming in.
Some corporate apps are starting to require you to scan a qr code with their phone app to login. You might encounter these type of 2FA sooner or later.
They just pay a vendor for it and don't care about the things you do.