do you need to 2FA over email? this always seemed like a bad idea anyway…
the TOTP approach seems good enough… its is basically a rotating secret number that you and the computer server knows.
can be provided via a dedicated app or hardware device. it allows for a small, lightweight way to secondary auth all the things without linking to your services.
The problem is there are so many shitty websites that don’t give you a choice and do TOTP only through email or SMS.
I even had one force me to use a specific shitty service/app for TOTP codes. Luckily, I found a way to steal the shared secret and put it in my favorite app instead.
My favorite is when it automatically prompts for passkey. I don’t have one, I never have, stop popping stuff up at me and let me put in my password. If I wanted to use passkey I’d click that button.
I especially like those websites where I’m not sure if I have created an account before. They don’t have a separate sign up, sign in, or forgot password. Just the one box. Enter your e-mail, get a link sent to you to “log in now”. Click it: “complete your profile to use our service”.
do you need to 2FA over email? this always seemed like a bad idea anyway… the TOTP approach seems good enough… its is basically a rotating secret number that you and the computer server knows. can be provided via a dedicated app or hardware device. it allows for a small, lightweight way to secondary auth all the things without linking to your services.
The problem is there are so many shitty websites that don’t give you a choice and do TOTP only through email or SMS.
I even had one force me to use a specific shitty service/app for TOTP codes. Luckily, I found a way to steal the shared secret and put it in my favorite app instead.
Certain websites don’t even let me enter my password and only have email login as an option. It’s infuriating.
Enter login email
Next
An email has been sent to …
(Sigh)
Click login instead
Password manager recognises the password field and completes
Next
An email has been sent with a 6 digit…
Use app instead
Password manager kicks in again
It’s like they’re at war with password managers
My favorite is when it automatically prompts for passkey. I don’t have one, I never have, stop popping stuff up at me and let me put in my password. If I wanted to use passkey I’d click that button.
I see you’ve successfully entered your password. Let’s make it more complicated next time
I especially like those websites where I’m not sure if I have created an account before. They don’t have a separate sign up, sign in, or forgot password. Just the one box. Enter your e-mail, get a link sent to you to “log in now”. Click it: “complete your profile to use our service”.
What the fuck.