do you need to 2FA over email? this always seemed like a bad idea anyway…
the TOTP approach seems good enough… its is basically a rotating secret number that you and the computer server knows.
can be provided via a dedicated app or hardware device. it allows for a small, lightweight way to secondary auth all the things without linking to your services.
The problem is there are so many shitty websites that don’t give you a choice and do TOTP only through email or SMS.
I even had one force me to use a specific shitty service/app for TOTP codes. Luckily, I found a way to steal the shared secret and put it in my favorite app instead.
do you need to 2FA over email? this always seemed like a bad idea anyway… the TOTP approach seems good enough… its is basically a rotating secret number that you and the computer server knows. can be provided via a dedicated app or hardware device. it allows for a small, lightweight way to secondary auth all the things without linking to your services.
The problem is there are so many shitty websites that don’t give you a choice and do TOTP only through email or SMS.
I even had one force me to use a specific shitty service/app for TOTP codes. Luckily, I found a way to steal the shared secret and put it in my favorite app instead.
Certain websites don’t even let me enter my password and only have email login as an option. It’s infuriating.
Enter login email
Next
An email has been sent to …
(Sigh)
Click login instead
Password manager recognises the password field and completes
Next
An email has been sent with a 6 digit…
Use app instead
Password manager kicks in again
It’s like they’re at war with password managers