My work 2fa can go away. I don’t give two shits if everything in the work app is printed in global papers, just stop making me go through a 5 step process to see my fucking roster.
Except when it’s just an email, or worse, a txt message, or worse, a whatsapp message, with no other option for using a proper 2fa generator…
But also, not every site needs 2fa, sometimes I really couldn’t care less if someone managed to hack into something, because I can just make a new account if that happened…
What really bugs me is that TOTP is objectively easier than any other form of 2fa. Just import the library, add the field on your login form, and you’re done.
Email verification is annoying to code, it requires SMTP or an email gateway, is slow for the user, is risky from a security perspective, and to generate the code you probably still have to implement TOTP.
SMS/RCS is even more annoying to code, it almost inevitably requires a third-party gateway, it can work differently if the user is in a different country or on a MVNO or in a low-signal area or just has the wrong astrological sign, is very slow for the end user, is almost useless from a security perspective, and you STILL have to implement TOTP.
WhatsApp messages are somehow even more annoying to code than that, requires an api interaction with Meta (which is never fun and poorly documented), requires the end user to have an account with a specific third party, is slow for the end user, relies on another company’s security posture to determine your own, and you STILL have to implement TOTP.
Making your own app for 2fa is undoubtedly the worst: not only is it annoying to code, it’s an ongoing annoyance that is strained through multiple app stores, adds an additional maintenance and support load, adds additional technical debt, adds an unnecessary attack vector, requires users to download another app, is often unreliable, is often pretty slow for the end user, is a total crapshoot from a security perspective, and guess what? YOU PROBABLY STILL HAVE TO IMPLEMENT TOTP.
Any company that chooses SMS or email verification over TOTP emphatically does not know what they’re doing.
2fa by email is probably slightly easier than TOTP, if the account verification via email is already implemented, but yeah, it’s not like it’s significantly easier…
You don’t have to implement totp for these alternatives… The “thing” about totp is that there’s a shared secret and a timestamp. Due to potential drift in clocks you need a window and period to know how many time steps to test, and how long each is.
But with an email/SMS/WhatsApp, there’s no shared secret. So you can simply send a random code, and store server side when it was generated. Totp makes no sense in that case.
Not that totp is difficult to implement at all. My implementation for work was what, less than 200 lines of C++ I think? I didn’t implement the sha1 myself though.
An earlier version of that comment said “something like TOTP,” but I guess I left that out while I was revising it. My point is you have to implement something that does most of what TOTP does anyway, so why not just use the version that’s already been stress tested?
Almost all sites should allow me to choose whether I want 2fac. And they shouldn’t prompt for it nearly as often as they do - some services do it for every login, most seem to do it every month at least.
Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It’s unnecessary bs.
Any account that does payment (like your netflix one), will be used to test out stolen credit cards. This will in turn flag your account for fraud. You might not want that. Unless you do, I don’t know
I don’t care. Likelihood is that’s not going to actually cause me anything but an annoyance anyway, so the cost of preventing it can’t be more annoying
Which also doesn’t matter anymore because companies sell our data all the time or just give it away through their own data insecurities. Or yanno, white pages. com and similar exists and its pretty easy to find anything about anyone anytime.
yes I do. I will take convivence over security most days. Just because you don’t, and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I’m sure you’re not stupid or ignorant of the risks.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
The day my taxes go towards paying for people who don’t have 2fa, we can discuss whether it should be mandatory. Also, comparing a compromised Netflix account to loss of life, really?
2FA is a good thing. You don’t want it to go away.
My work 2fa can go away. I don’t give two shits if everything in the work app is printed in global papers, just stop making me go through a 5 step process to see my fucking roster.
Except when it’s just an email, or worse, a txt message, or worse, a whatsapp message, with no other option for using a proper 2fa generator…
But also, not every site needs 2fa, sometimes I really couldn’t care less if someone managed to hack into something, because I can just make a new account if that happened…
What really bugs me is that TOTP is objectively easier than any other form of 2fa. Just import the library, add the field on your login form, and you’re done.
Any company that chooses SMS or email verification over TOTP emphatically does not know what they’re doing.
2fa by email is probably slightly easier than TOTP, if the account verification via email is already implemented, but yeah, it’s not like it’s significantly easier…
That is a fair point. But again, you probably have to implement TOTP or something like it anyway, to generate the code.
You don’t have to implement totp for these alternatives… The “thing” about totp is that there’s a shared secret and a timestamp. Due to potential drift in clocks you need a window and period to know how many time steps to test, and how long each is.
But with an email/SMS/WhatsApp, there’s no shared secret. So you can simply send a random code, and store server side when it was generated. Totp makes no sense in that case.
Not that totp is difficult to implement at all. My implementation for work was what, less than 200 lines of C++ I think? I didn’t implement the sha1 myself though.
An earlier version of that comment said “something like TOTP,” but I guess I left that out while I was revising it. My point is you have to implement something that does most of what TOTP does anyway, so why not just use the version that’s already been stress tested?
I don’t think the 2FA is the issue this comic is attempting to convey.
Except that it needs another jump for autofill 2fa
Almost all sites should allow me to choose whether I want 2fac. And they shouldn’t prompt for it nearly as often as they do - some services do it for every login, most seem to do it every month at least.
I don’t want it for like 95% of the logins I have.
Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It’s unnecessary bs.
Any account that does payment (like your netflix one), will be used to test out stolen credit cards. This will in turn flag your account for fraud. You might not want that. Unless you do, I don’t know
What? Like they’d try and use a stolen credit card to pay for my service?
They won’t be paying, just tokenizing the cards to see if the data is good.
Sounds like it wouldn’t be a problem at all, for me, and really a problem for the police or netflix or the credit card company.
The bigger issue is gaining account details and personal info for identity theft.
I don’t care. Likelihood is that’s not going to actually cause me anything but an annoyance anyway, so the cost of preventing it can’t be more annoying
Which also doesn’t matter anymore because companies sell our data all the time or just give it away through their own data insecurities. Or yanno, white pages. com and similar exists and its pretty easy to find anything about anyone anytime.
I get the theory, but if it itself relies on some login-based service (like email) it becomes a kind of chicken and egg problem.
Click login button -> Autofill username, password & totp token -> Done
(And staying signed in not working is an intentional side effect of deleting cookies and temp data on closing the browser…)
yes I do. I will take convivence over security most days. Just because you don’t, and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
Good thing you aren’t in charge of anything, then.
Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I’m sure you’re not stupid or ignorant of the risks.
As a user its annoying, as a developer it is incredibly frustrating and time consuming.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
What?
Implement TOTP and let your users use their preferred authenticator and none of what you’re struggling with will apply.
Oh, yeah, and of course there’s someone on the internet talking about the MFA protocol that no corporation uses.
That one is obligatory too.
(Anyway, yes, if you need MFA, use TOTP. That’s a non-brainier. Except that corporations don’t have brains.)
Which also means you can just copy/paste it alongside username and password with the same manager.
👆️
This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
there, now you are getting it.
i dont want you not wearing the seatbelt, it is so easy to do
we live in a society and im tired of paying for stupid doing stupid things
The day my taxes go towards paying for people who don’t have 2fa, we can discuss whether it should be mandatory. Also, comparing a compromised Netflix account to loss of life, really?
comparing cost to society
there is a reason ms forces updates now