Do you use 2fa?
Most providers seem to support time-based two-factor authentication (2fa) these days. i.e., Google Authenticator, Authy, LastPass, and so on. A few support other forms such as through a YubiKey or an SMS-based verfification code. However, I assume the majority of customer accounts are only being protected by passwords. I'm curious to hear about customer and provider experiences with the tech.
Feel free to complete the poll and then provide additional detail in follow ups. I'm interested to see some follow up discussion on topics such as:
- Why you actively choose not to use 2fa, if that is your choice?
- What rough percentage of your providers support it?
- If you're a provider, what rough percentage of your customers enable it?
- What problems have you run into with it, as either a customer or provider?
- What 2fa method/app do you like and why?
2FA usage
- Do you use or support 2fa?75 votes
- Yes86.67%
- No13.33%
Comments
I do, but not for EVERYTHING.
Just the ones I think are important and paranoid about
Enpass for personal and Okta (I know right) for work-related stuff.
"The imitator dooms himself to hopeless mediocrity." — Ralph Waldo Emerson
I've got yubikeys but not sure I'd want that on VPS stuff frankly just because implementation has to be quite good to avoid lockout.
Well, if they support it, yes.
If they force me to retarded things like SMS, because its more secure, kek.
Free NAT KVM | Free NAT LXC
Yes
Amadex • Hosting Forums • root.hr
I use aegis.
The methods are usually dictated by the service, but if offered, and as I always have a YubiKey plugged in here for SSH/SFTP access, FIDO/FIDO2 preferred (Google,GitHub,Shopify) followed by TOTP (everyone else). FIDO is just so much simpler, and even TOTP is easier with a key, you can generate then cut/paste the code directly on the PC without having to reach for and transcribe from a phone.
Not sure that's sooo much of an issue, most services provide emergency code access to keep offline for the rainy day, or do TOTP in addition which you could keep offline too or just use as a an alternative.
+1 for aegis as the phone based TOTP app.
I avoid 2FA as much as possible, because I don't like the idea of having to grab the phone when I'm on the computer.
Some sites are forcing 2FA though:
We accept Karma donations for the last flan. 🍮 affbrr
No.
Requiring the phone is terrible to me.
I ended up using codes twice while trying to set up it & it failed...and that was on cloudflare and namecheap.
Many here are very skilled for sure, but not quite cloudflare engineering team skilled so definitely more risk of bad implementations.
I think 2FA is mostly needed for the folks who reuse (admin123) passwords on many accounts.
Enforcing it makes the providers' life easier.
Having said that, for the important stuff (especially emails used for service registration), I think it's not a bad idea.
It is a hassle though. Yes, you get bacup codes, but having to carry and use a "smart" phone is not to my liking.
That's the main reason why I use Authy (my article on it).
Yes, I know, it's by that company. Nonetheless, it lets me use a computer for 2FA, and that's a must as far as I'm concerned.
🔧 BikeGremlin guides & resources
Why wouldn't you use it?
Edit: if combined with a good password manager (not Lastpass, for example - in my opinion) it's pretty easy to manage.
I use it on everything that supports it.
I wouldn't hesitate to turn on the 2FA if it was very important APP or website, Authy is the best, I can barely get online without it now.
Authy is closed source and doesn’t provide an easy way to migrate. Do yourself a favour and pick an open source app that makes migration simple if needed.
If it's supported, I may use it as long as it doesn't involve SMS.
Aegis is my favourite 2FA app.
Is there an open source option that has a desktop flavour too? I mostly ended up with Authy so I didn't have to go find my phone all the time.
By migrate, do you mean migrate to another phone, or migrate to a different 2FA app?
Use hardware key like yubikey, it is as simple as touching the key, worth the hassle compared to the security benefits 🙂
Yubikey also can be used to keep TOTP
You forgot GitHub when out of the blue it tells you to enter a security code sent to an e-mail you haven't accessed in 5 years
Solutions to forced 2FA:
big brain: in Firefox there's a neat config switch
security.webauth.webauthn_enable_softtoken = truewhich allows you to emulate a hardware security token. Works even for Google account.huge sigma gigachad brain:
I feel that 2FA is the only way to the future. Password auth is a thing of past now. It's way too vulnerable and impractical as we require more complex passwords.
♻ Amitz day is October 21.
♻ Join Nigh sect by adopting my avatar. Let us spread the joys of the end.
What desktop OS are you using? There are a few decent options but they’re OS specific.
To a different 2FA app. From memory, device migration on Authy is fine so long as you remember to enable the multi-device option.
This. So many corporate IT breaches could be avoided simply by enforcing 2FA. We’re at the point that social engineering techniques are so advanced that it’s irresponsible not to enforce 2FA unless you literally do not care about the system in question being compromised.
I always enable 2FA wherever possible. Additionally, my preferences of methods is as follows:
Cheap dedis are my drug, and I'm too far gone to turn back.
It's not much of a hassle at all until the key goes the way of all hardware.
Then you need the backup key (which Yubi does tell you to buy, so they get twice the sell) - good luck finding that. And hopefully all the sites are properly registered.
Now, consider when you want to access something and you don't have the key with you - because you didn't want to lose the key because of the inconvenience of the above. Especially email..
For a bonus, consider that any provider's backup can drop you arbitrarily, intentional or not - see people dropped from the Google or Apple ecosystems, unable to log into their device. Now you are on a loaner device - can you access any of your accounts?
2FA is a hideous design mistake, that puts the burden on the individual and has ended research into better methods of limited privilege and limited time authentication.
The alternative is a small number of memorable password patterns, with a paper backup sealed in a envelope, and put in a fire-resistant safe.
It doesn't protect against phishing (directly) but neither does 2FA
Primarily Linux; Authy works seemlessly on both my (Android) phone and (Linux) desktop which covers most of my bases (I'm rarely on Windows when I need 2FA).
I know these days 1Password will play, but putting my 2FA in the same app as my passwords feels... wrong.
Yup. That's what kept me from going that route for long but eventually decided to bite the bullet and just get two.
One on my house keys that goes with me and one permanently attached to desktop. So I figure if there is a fire one of them is likely to survive...and if neither does...then lets just say it is probably no longer my problem
I don't use 2FA for everything, but when I do I use a Yubikey. Just annoying to have to remember to keep it nearby.
RamNode: High Performance Cloud VPS
NYC - LA - ATL - SEA - NL - DDoS Protection
Is there really anything else to say?
"I disagree" ?
Mine's a slight twist on this, one on my house keys, that still needs to be plugged into the desktop to access most things, the backup stored securely in the basement. 2FA aside, this way I mostly always know where my house keys are having once left them overnight hanging in the door in full view of the street.
I'm not sure where you could "disagree" but I believe you will try. And the fact that you - like many others, no worry - accepted 2FA because you think it's not a big trouble is not exactly an "agreement".
Trust me, I can disagree. You may disagree with my disagreement but that's fine too.
Not sure if this is a language thing. It kinda is an agreement.
1) harmony or accordance in opinion or feeling.
They think this makes my account more secure and so do I.
2) a negotiated and typically legally binding arrangement between parties as to a course of action.
They said "We'd like you to 2FA your account for security" and I said "Okay" and did.
Why are agree and disagree in quotation marks?
Some comments seem like missing the fact there is also the backup code - or I'm missing something.
I.e. if you can't use 2FA, for whatever reason, you can use the backup code to log in, disable it (and re-enable with a different method if you like).
🔧 BikeGremlin guides & resources
use KeePassXC + KeePassDX (Android)
I just configure my applications/websites to sent an OTP via email when logging in/registering an account. SMS/Authentication Apps are nice but email verification codes should be more than good enough tbh.
Web Development & SysAdmin services
2FA and an auth key are the only way for the future.
Passwords should be phased out progressively.
♻ Amitz day is October 21.
♻ Join Nigh sect by adopting my avatar. Let us spread the joys of the end.
Is anyone using (or at least acquainted with) SQRL? (The site gives off strong 90's vibes, but one can look through that)
I thought it to be an interesting technique, got the Android app once I got an Android phone and created a key.
Now I silently wait for the method to be used in the wild.
>
Yeah it is right. The drawback is that we need more than one hardware key according to your disaster recovery plan. It is like managing backup in server and I already do it anyway, so it is no problem.
The feeling of my accounts are safe as long as I have the key and have good DR plan is really good 🙂
Yes i use 2fa, then i break my phone screen.
Not using it
I use it everywhere I can. The more protection the better, especially with all of the data breaches. Of course, if the 2FA secret is stored with the user data, it may not help.
At the cost of being nitpicking - every (layer of) protection usually adds more complexity and impracticality of use, so there's always a point past which more is no longer better, not in practice.
🔧 BikeGremlin guides & resources
Broadly agree though I think there can be exceptions. e.g. for me getting into gmail is faster since moving to yubikey. Or alternatively SSH'ing into a server via key can be more convenient than pwd once set up
Absolutely true. In the case of 2FA, I'm willing to pay the cost to get what I consider to be significant benefit.
I had a PayPal keyfob token that I used for many years. Press the button, and it displays six random digits that you append to your password. When the battery died, the token disabled itself.
At some point over the years, PayPal added a requirement that you must supply your cellphone number to make any changes to your PayPal account settings. The last thing I want is for PayPal to have my cellphone number. It took a few tries and a little social engineering, but I was able to get a PayPal customer service person who was willing to disable two-factor authentication for me so I could access my account.
Password changes are not coupled to providing a cellphone number, so I changed the password for security. I always use a long, strong, random password. I can use the password to make payments for online purchases, but I can't login to my PayPal account without running into that "Cellphone Number?" wall.
Weird, I've never had to do that with my Paypal account. They don't have my phone number and I can make account changes just fine.
It was the same for me, until the PayPal token failed and I locked myself out with too many attempts to login.
Another trick that worked in the past was when you see a prompt for information you do not want to provide (e.g., cellphone number), hit the back button and try loading the desired page again. It used to disable the "needs to see cellphone number prompt" for that session. That trick no longer works at PayPal, but it often works elsewhere.
After I got phone service to unlock my account and disable two-factor authentication, I was able to do the "forgot password" to change my password. I don't try to login to the PayPal main page, to stay away from those cellphone prompts. I just use PayPal for website payments.
As in need to receive an SMS to proceed? I've never seen that on Paypal (albeit EU).
Paypal EU use TOTP (App based) 2FA and I'm very happy to have that enabled.
I assume that PayPal uses SMS to confirm the cellphone number that you provide. I never got to that step. I run very few apps on my cellphone and never use it for banking or payment services.
My concern is that PayPal could and would provide my cellphone number to merchants and others without my knowledge or consent. The last thing I want is a barrage of ads and notices on my cellphone coming from merchants. At present very few know my cellphone number, and I like keeping it that way.
I was once caught in a situation where I got locked out of a website for some reason. Things went awry when I learned that the "lost password" reset mechanism expected to send an SMS message to that landline phone number. I had expected a phone call where a computer-generated voice reads a random number, but it did not work that way.
Yes, I use 2FA (Google Authenticator) on both websites and ssh login.
My servers ssh/PAM setup are
I use nullok (Google Authenticator) and Match Users/Group in sshd_config to disable 2FA for users or a group on servers where scripts log in via ssh.
I actually maintain a cheap cellphone with a dirt cheap plan just for 2FA purposes. No data on it, just talk and text.
I don't use my main phone for 2FA.
♻ Amitz day is October 21.
♻ Join Nigh sect by adopting my avatar. Let us spread the joys of the end.