[jck86]

> 2FA on every trivial site

But it helps against account sharing, err I mean they make database leaks irrelevant except for private info of the customer, err I mean that we can now send more mail to the customer about new AI features without risking they think it is phishing, err I mean this is the easiest measure for the auditor findings so since we implemented this we don't need to fix all the crappy internal api auth problems and atrocious out of date dependencies, err I mean...

[TeMPOraL]

> But it helps against account sharing

This is actually a feature, very common in real world, that security maximalists keep insisting is a bug.

[Marsymars]

My wife's insurance provider requires SMS 2FA, which is incredibly annoying for this reason - there's no way for me to submit my massage (or w/e) benefits even though my wife hates dealing with insurance admin and I have the login info and am authorized to do so - I have to wait until my wife is home and then get her to read off an SMS code for me.

[TeMPOraL]

But that's the thing: SMS can be auto-forwarded without that much effort. Definitely without rooting your phone. I don't recall if there is any built-in functionality for this, or at what granularity, but in the past I had a Tasker profile specifically meant to forward very specific SMS 2FA codes.

Now try that with a bank/vendor app. Or any other communication app. Nowadays, many don't even put the message body into the notification anymore, so you can't forward it via another channel (e.g. via SMS).

[Marsymars]

Yes, proprietary app-based authentication is the worst possible authentication scheme, but thankfully I don't need to use any services that insist on that.

[fragmede]

Setup a Google voice number as her number in the system and have it forwards to you, with your wife's consent.

[Marsymars]

a) Google voice doesn't operate outside of the US, and I'm not aware of any equivalent that does, short of setting up, paying for, and managing a full-fledged voip line (e.g. with voip.ms) which are pretty finicky with 2FA codes.

b) These systems are a general pain when you need to deal with human support if your number on file doesn't match the number you call them from. I have a few different numbers that I use variously and run into this every so often - I get a barrage of extra verification questions if I call from a non-matching number, callbacks seem to happen randomly between my number on file vs. my number listed in a ticket, etc. My wife teases me about constantly breaking systems due to hitting untested edge cases.

(Tangentially, various systems will require you to input a phone number with no information stating that it must be a number capable of receiving texts, and at some future date will try to send your landline authentication codes via SMS.)

[bigbuppo]

Except for Microsoft, who just sort of scale back MFA (unless you pay for Microsoft 365 Pro Gold Deluxe Plus Platinum Millenium Edition E5 to set the policy that used to be free) because of reasons.