Not once was I asked if I wanted 2FA (two-factor authentication) for my Apple or Amazon accounts.
I don’t want 2FA, because, being homeless/poor, you frequently lose access to phones and the like. That’s why a lot of homeless people will have like a dozen abandoned FB accounts (I have 3), because we just haphazardly use the suggested “secure password” to log in, and then someone steals our phone, or we lose it, or drop it in the toilet.
So no, Apple, I don’t have that device anymore. I don’t have that phone number either. Or access to that email address. The last four digits of a debit card I’ve used? b0i.
The one thing I do have?
MY FUCKING PASSWORD
I’m getting locked out of accounts I have the fucking password for! What the FUCK?
I feel you.
when you’re in a different country and using a different sim card and trying to log in to your email: we just sent a text to your phone. oh you can’t use that phone number? tough luck. you’re probably not really you. we’re going to stop you from using your own account
or when you’re in a country that restricts access to certain platforms but not others: we sent an email to your backup email. can’t access it? screw you, user. how about we send you a text message? haha, you can’t do that either, loser? how about we lock you out of your account?
i agree with the OP, 2FA is a bunch of techbro bullshit 80% of the time and designed to make you link your real name or phone number or other accounts to this account, for data purposes
Blame the implementation, not the concept.
Everyone’s risk profile and tolerance is different. Out-of-band (OOB) authentication using unencrypted SMS txts or audio to a phone is low-assurance, but it’s better than nothing and these companies want to push the cost of a compromised account to you wherever possible. And your 48 character mixed case random password can be awesome, but it is only as secure as the database that’s storing it and the connection its being transmitted over. This is ideally why you want a unique password for each account, so if you phpbb forum account password is compromised they cant use it to get to your email.
Time-based one time passwords (TOTP) are not bad and can be managed in staples like KeePass databases that you can keep in your own cloud/devices. But having them on multiple devices like authy, or in the same KeePass database as your passwords, does negate their value to a degree and somebody could copy it and use it without your knowledge. If it’s the best option you have though then it’s the best you can do. I’d probably do this where available if I didn’t think I could maintain reliable access to a phone or email.
FIDO2 keys that work with USB or NFC on a phone are a great alternative to OOB, and you can take it on travel anywhere you can take a phone. IF you can afford them, get 2 and keep one in a secure location as a backup.
I had a long period of time where using the mandatory government 2FA system was virtually impossible for me because my phone was too old and fucked up to keep the browser session and the 2FA session alive simultaneously. I was effectively barred from using any of the useful banking and healthcare apps because I couldn’t sign in. Reading government mail or ordering meds online became so logistically complicated that I simply didn’t do it. Their official support consisted in a condescending website treating you like your problem was that you were too stupid to read the text on the screen and where there possibility of technical hiccups on their post was never considered. Calling or writing their support essentially got me the answer “just buy a new phone or get fucked”.
that sucks yeah but we can’t keep supporting shit forever in the current context. internet explorer 6 was an anchor on all of webdev for far too long, for example.
If the government can’t guarantee universal access to it’s digital programs than it has to offer equivalent access through analog channels.
Yeah, and 2FA is so slapdash depending on who is asking you to use it. There is very little reason why any 2FA system couldn’t support, say, letting you store the 2FA token in your password manager, but a lot of them will INSIST that you have to get a text message or an email. There is very little reason why these systems SHOULDN’T let you use one of these:
The only thing that might get in the way is the level of complexity of the OTP it generates. I mean, maybe there is deep levels of nuance I’m not seeing here, but I manage a Duo instance for my day job and could support everything from email codes, text codes, phone push notifications through the Duo app, all the way down to those cheap little hardware devices that use an 8 segment display to give you your numbers.
because we just haphazardly use the suggested “secure password” to log in, and then someone steals our phone, or we lose it, or drop it in the toilet.
You should probably use a password manager like Bitwarden. Just remember the one password and you can get into anything.
2FA is also really important, otherwise everyone’s getting hacked 24/7.
Admin is going to add 2FA to individual posts and you’ll change your mind.
A password manager doesn’t really solve OP’s problem, though.
By contrast, the authenticator app Authy allows you to save your 2FA codes securely in cloud storage, which means that upon installing it on a new phone, all the 2FA codes are available. (It’s basically the same as Google Authenticator or similar apps, but with free, password-protected cloud storage included. Notably, this type of 2FA is much more secure than SMS-based 2FA anyway, so it’s better all around.) Not every site/app offers this type of 2FA, but most do.
That said, a password manager is also a good idea for anyone who cares about securing their accounts (which should be everyone).
Bitwarden (or Vaultwarden) does let you save 2fa codes. Passkeys too.
Requires either paying for premium or self hosting though, neither of which is presumably an option for OP.
i agree with this completely. without 2fa your accounts are gonna get taken, its just a matter of time and/or will.
I think it’s a mistake to treat security as uniquely important. Accessibility matters too. Not being able to access your accounts is just as bad as someone else being able to access your accounts.
You will be hard pressed if you want to add an accessibility feature to a service which undermines security. For banking and government services, people should be able to physically present to a bank or government building with an ID if they cannot access a service online, but allowing non-2FA online access to banking, tax or healthcare is a massive security risk which needs mitigated somehow. Fraud is not an acceptable risk for accessibility requirements. 2FA codes are the only real way to authenticate against online services in a way which prevents malicious actors for most cases. Passwords leaks, brute force and botnet attacks are the reality of modern security considerations.
Fraud is not an acceptable risk for accessibility requirements.
Good thing that we don’t have a record level of fraud. Making everything worse was definitely worth it.
that depends very much on the account and what it controls access to
Who and why though?
lot of things you can do with a hijacked account, including trying to phishing attacks on accounts on your friends list or contacts. Having poor security practice, even if there’s a good reason for compromise, puts everyone you know at greater risk.
your friends list or contacts
ah so my accounts are safe because I dont have any.
sure, you’ll just get the random bots offering art commissions or mr. beast bucks.
I mean if some person needs to create new accounts because they keep loosing access to their old accounts their contacts are just as vulnerable to impersonating accounts as to someone hijacking the account.
I’m shit with keeping track of stuff but KeePass , aeagis and syncthing is what saves me
