My personal conspiracy theory: the reason so many sites and services push for mandatory 2FA nowadays is to have an excuse to harvest phone numbers.
My personal conspiracy theory: the reason so many sites and services push for mandatory 2FA nowadays is to have an excuse to harvest phone numbers.
Any 2FA that sends you an authentication code though SMS is masturbation. That "secret" code is getting broadcasted over the air in cleartext. Time-based OTP is the only reasonable solution.
If you're willing enough to intercept my text messenger data and hack my system to know my login credentials and password before doing it, I'll just let you into my mcdonalds rewards account myself.
I hate the ones that push their shitty 2fa app for only their one service
yes that and the fact that phone numbers are more difficult to create and keep compared to emails. you can have a hundred gmail accounts but you can't have 100 SIM cards (yes there are VOIP numbers but those cost money too).
And companies frequently prohibit VOIP numbers from being used for 2fa.
Surely they have our best interests in mind
SMS is the least secure form of MFA that I'm aware of, so objectively, yes.
TOTP?