[seplox]

> When I tell people I work on authentication software, I nearly always hear some version of the same story: I hate multifactor authentication. No, really. People hate this stuff.

I hate all of the half-cooked non-TOTP MFA methods that I'm forced to use. Just let me use my freaking authenticator app. If you believe that your users prefer (or maybe it's just you?) more databroker-friendly methods, then fine, but please at least provide TOTP as an option.

[cosmic_cheese]

I wish that banks would offer TOTP. SMS is famously insecure and poorly suited for something that’s a load-bearing pillar in most of our lives, and TOTP is probably the most reasonable replacement. Unfortunately only a tiny handful of US banks offer non-SMS 2FA of any kind, and to my knowledge the one that does (Scwhab I think?) requires the use of a hardware gadget even though it’s standard TOTP (which people have written python scripts to extract the necessary bits of info from).

[hinkley]

To this day I'm just amazed that World of Warcraft tried to mandate security tokens in a time when E*Trade barely supported them.

Why is a video game embarrassing fintech?

[abdullahkhalids]

World of Warcraft was supporting tens of thousands poor teenagers in developing countries, who would farm high value items in the game and then sell the account /items to rich people who didn't want to put in the hard work.

There was (maybe still is) lots of money to be made by hacking accounts and selling them.

WoW was fintech!

[FirmwareBurner]

>WoW was fintech!

WOW was teaching kids how free market capitalism works early on.

[toomuchtodo]

Fidelity offers TOTP standard support, works with the native Apple Password app/keychain.

[cpburns2009]

Only recently. They used to require Symantec's authenticator.

[tn1]

Schwab supports Symantec VIP but there's a python package to emulate it, which will give you a regular TOTP setup code.

[riedel]

At least in Germany all the SMS 2FA has been shut off, but replaced with tons of custom 2FA apps. The security argument is certainly that they can check for 'insecure' devices. But I wonder what the empirical evidence here is and how often (compared to phishing/social engineering) a TOTP token was actually stolen. Worst thing is IMHO Microsoft now which seem to have also shut off the TOTP option and use some other propriatary 2FA scheme now. IMHO banks should simply use FIDO2 HW tokens, but with all that passkey bullshit it becomes unlikely...

[GoblinSlayer]

A failure scenario I found is when mitm antivirus decrypts traffic (or something similar), so a proprietary 2fa scheme doesn't work, because it can't get through network.

[7bit]

No it hasn't. How can you make a statement so confident, when obviously you couldn't objectively know?

[nh2]

Evidence to the contrary?

For my German banks, this is true. Stupid custom apps and proprietary reader hardware that read coloured moving QR codes everywhere.

[7bit]

It's your responsibility to provide evidence for your claims, not everyone else's to prove yours wrong...

[nh2]

You say "no" to the poster saying "in Germany all the SMS 2FA has been shut off".

It makes sense to ask you for evicence: You'd just have to name a bank that provides SMS 2FA.

[arccy]

totp is still terrible, still phishable, more annoying to enter or use. it's only tolerable because it's better than the other methods you might see (email, sms, custom app), but imo it also falls into the half baked category behind things like passkeys.

[EatFlamingDeath]

Yes, for the love of god and all that is holy, just let me use TOTP for MFA. I absolutely HATE that some banks use SMS as a method of MFA. Sometimes it's a mix of 8 character numeric password with SMS as MFA.

[esseph]

A passkey is far better than TOTP for security to the point that TOTP should probably be deprecated already.

[7bit]

Passkeys don't replace all use-cases for TOTP

[lanfeust6]

TOTP still seems good enough for most things

[esseph]

It's like picking WEP for your wifi

https://www.cisa.gov/sites/default/files/publications/fact-s...

[ongy]

At best WPA2. WEP is broken in ways that don't need human fault.

The only downside of TOTP to FIDO and friends (from a security perspective) is phishing resistance

[tialaramex]

Because of how humans work TOTP can give false confidence to the user which is a further downside.

Grandma goes to fakesite.com not realising it isn't her real site. It asks her for the TOTP code, she provides her TOTP code and it works. She is reassured - if this wasn't her real site why would the code work?

Now, in theory a neutral security assessor can see that's not reassuring, but that's not how humans work, the fact there was a challenge-response feels like security even though for all they know if was accepting any inputs.

Phishing sites generally have a milder version of this effect. I have vanity mail, so I own the "mail provider" handling my email and yet of course I get those phishing mails saying as the "Administrators" of my vanity domain they need me to type in my password. But they don't know my password of course, so filling in their form with crap "works" the same as anything else, fuckyouscammers, sure that's a reasonable password.

These schemes can't work if you don't rely on stupid shared human secrets ("Passwords") everywhere, but we did and it seems many people are really enthusiastic to keep doing that, so I doubt we'll escape from this self-imposed status. I wanted to make a web site that mimics the famous reusable Onion article but I've never gotten around to it. "No way to prevent this"

[lanfeust6]

Find me a grandma using TOTP. It would confuse them too much.

[bigDinosaur]

That's a pretty major downside to OTP's and certainly not one that can be offhandedly dismissed.

[lanfeust6]

It is for general population. I don't think HN users for instance are particularly concerned about phishing sites.