Technology

35124 readers

130 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.

Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.

Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago

MODERATORS

[email protected]

164

Why Do Companies Not Use Existing 2FA Standards? (lemm.ee)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

78 comments fedilink hide all child comments

This is something I am seeing more and more of. As companies start to either offer or require 2FA for accounts, they don't follow the common standards or even offer any sort of options. One thing that drives me nuts is when they don't offer TOTP as an option. It seems like many companies either use text messages to send a code or use some built in method of authorizing a sign in from a mobile device app.

What are your thoughts on why they want to take the time to maintain this extra feature in an app when you could have just implemented a TOTP method that probably can be imported as an existing library with much less effort?

Are they assuming that people are too dumb to understand TOTP? Are they wanting phone numbers from people? Is it to force people to install their apps?

*edit: I also really want to know what not at least give people the option to choose something like TOTP. They can still offer mobile app verification, SMS, email, carrier pigeon, etc for other options but at least give the user a choice of something besides an insecure method like SMS.

you are viewing a single comment's thread
view the rest of the comments

[–] loutr 20 points 1 year ago (2 children)

Most people simply don't get the point. They don't understand, let alone care about, digital privacy and security.

Anecdotal evidence: I have a short Gmail address (think [email protected]), and a lot of smartasses use it to subscribe to everything, mostly as a throwaway but also on e-commerce sites, fintech bullshit with access to their bank accounts, ...

Once I got curious and reset the password, logged in and the moron had already filled in all his personal info, including his credit card. Another time I sent an SMS to the guy asking him to stop, he replied "it's my address, my nephew set it up for me, I guess we just have the same one".

These guys would never take 10 minutes to set up a 2FA app.

[–] [email protected] 7 points 1 year ago

Similar happened to me. I've had a Gmail since the beta days and a fairly common name. I get sensitive documents sent to me, random order confirmation, even a flight confirmation that I signed into to try to find his phone number so I could text him. I'll admit I wanted so badly to cancel his flight. But I didn't. Texted him and told him he needs to reset his pwd. Just so careless.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago)

people are even dumber than I realized holy shit. I knew people weren't willing to go far for security measures but this is actually much worse than I would have guessed.

laziness, ignorance, or privilege? I'm unsure which of the three causes this. I find it hard to believe it's ignorance because online scams and hacks are very well known and I've always hated "laziness" as a concept.