- fucking annoying
- can't believe they sold people that it's BETTER to have to get your phone out to login
- incredibly annoying
- if you're using this willfully you're clearly just as worried about security as before anyway
- companies love having real phone numbers to pair with 'their' data
I like yubikeys since it means I don't have to pull out my phone. totp on the laptop also works well enough.
sms based 2fa is the worst. it seems like to me every ceo and other non-technical c-level person I've known personally loves sms based 2fa though because they can't figure anything else out.
They like it because it’s cheap and easy. They pay a phone provider for the 4 digit phone number and type in a script to generate a random code and text it. There is no oversight or maintenance.
Pairing with an Authenticator app is easy, but a little more work. Pairing with a mobile app can get a little tougher and require development plus maintenance in making sure the app cannot be spoofed and works with updates. Using a physical drive for 2FA is a pain in the ass to set up. From a business standpoint, 2FA only needs to work enough to remove liability from your business. If someone spoofs your cellphone number that’s on the phone provider not them so that’s enough to remove liability