This is something I am seeing more and more of. As companies start to either offer or require 2FA for accounts, they don’t follow the common standards or even offer any sort of options. One thing that drives me nuts is when they don’t offer TOTP as an option. It seems like many companies either use text messages to send a code or use some built in method of authorizing a sign in from a mobile device app.
What are your thoughts on why they want to take the time to maintain this extra feature in an app when you could have just implemented a TOTP method that probably can be imported as an existing library with much less effort?
Are they assuming that people are too dumb to understand TOTP? Are they wanting phone numbers from people? Is it to force people to install their apps?
*edit: I also really want to know what not at least give people the option to choose something like TOTP. They can still offer mobile app verification, SMS, email, carrier pigeon, etc for other options but at least give the user a choice of something besides an insecure method like SMS.
Because Two-Factor Authentication is generally supposed to be under the principle of “Something you have and something you know”, the password being the “know”, and using a TOTP on an app via your phone would be the “have” (the phone).
I suppose if your email is restricted to the something you have/know it’s a bit better, and certainly better than nothing - but not by much.
Alternatively, if your e-mail provider does offer a more secure 2FA solution, then sending a temporary code to your e-mail address would be a valid 2FA method by proxy. So it’s not entirely a bad idea. (Although I’ve yet to see an e-mail provider that enforces 2-factor)
Protonmail. I dont have a backup email registered for recovery so if i loose my password and 2fa im totally fucked
Same, which is why I use a password manager and periodically take encrypted backups. The average person isn’t going to do that, but I like having the option to use email 2FA instead of SMS, since I can make email 2FA pretty secure, but I can’t do that for SMS.