[ndesaulniers]

One thing I don't understand about the suggestion to remove my phone number from 2FA is that 1FA seems worse. I'd prefer something like Google authenticator, but none of my banks offer that. Did I misunderstand the suggestion? Is there something else I should do?

[chinathrow]

> but none of my banks offer that. Did I misunderstand the suggestion? Is there something else I should do?

Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. If you really need to keep that account for reason X, move out all your assets to another bank and keep enough funds to fund X there.

[kube-system]

> Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there.

Have any suggestions for a bank that supports TOTP? I have yet to find a decent bank in the US that supports this.

[gnopgnip]

https://web.archive.org/web/20200202222301/https://twofactor... has a list of large banks and 2fa methods.

Charles Schwab and USAA use TOTP but aren't exactly main stream banks. Both use a Symantec client and don't officially support third party authenticator apps.

[ndesaulniers]

Thanks for the link! A more updated source seems to be hosted at https://2fa.directory/#banking currently.

Not too many banks with physical locations in my area AND 2FA more secure than SMS.

[vdqtp3]

First Tech Federal Credit Union and Fidelity both support time/token based auth although it's Entrust or Symantec VIP, not open TOTP

[kube-system]

I really wish there was some bank would support plain TOTP. I don't want 5 different solutions to managing my TOTP tokens. I already have one.

[closeparen]

Phone support at Fidelity will turn off VIP for you as long as you can answer at the account phone number.

[foobiekr]

this and they are not alone, it's horrible

[chinathrow]

I am not in the US but I'm sure fellow HNers can help you out.

[PeterisP]

The problem is that often adding the phone number just says "2FA" but in reality becomes as another single authentication factor (e.g. in credential reset workflow) - and, given the risk of SIM swap, it may be weaker than proper 1FA e.g. a good password.