this post was submitted on 22 Aug 2023
395 points (98.5% liked)

Technology

34795 readers
412 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.


Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.


Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago
MODERATORS
 

I personally am fine with this.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 3 points 1 year ago (6 children)

2FA is the biggest bane to my productivity in the last 15 years, no part of my work life should require me to pull out my magic distraction device.

[–] [email protected] 26 points 1 year ago* (last edited 1 year ago) (2 children)

Use a password manager that lets you autofill 2fa, like Bitwarden.

[–] [email protected] 2 points 1 year ago (1 children)

1password does this, too and it's magical. I've had my SMS go to my browser via Google Messages for a while, but it's so much easier to just auto-fill it instead of copy/paste

[–] [email protected] 3 points 1 year ago

Also, 1password logs you out when you stare at it wrong, so I'm not worried about someone who would somehow get local access abusing it.

[–] [email protected] -1 points 1 year ago (2 children)
[–] [email protected] 13 points 1 year ago

Is it less secure than it could be? Yes.

Is it better than no 2FA? Also yes.

In the end if it doesn’t work for your security model, than more power to you. But if it helps to increase the security of the average Joe, it’s good advice.

[–] [email protected] -1 points 1 year ago (1 children)

Allowing a smartphone access to anything sensitive is even worse advice. Smartphones are notoriously insecure.

[–] [email protected] 1 points 1 year ago

You're right. Dont grant your smartphone access to your GitHub. Just give it one factor.

[–] [email protected] 12 points 1 year ago (1 children)

I don't like how a lot of things require their own custom app, especially when there's no automatic notification. I need to try and remember what the app is called, open it, navigate through, then approve it

[–] [email protected] 0 points 1 year ago (1 children)

I like the app setup rather than shoving everything into a browser. But I'm not a fan of this 2fa stuff. I get the point is security, but let me decide which app/method to use, and whether I want to use it at all. Otherwise it's just annoying.

[–] [email protected] 2 points 1 year ago

I'm absolutely a fan of choosing which method to use, and also a fan of requiring choosing one. I prefer Google Authenticator-style 2FA (I use Aegis, but there are plenty of options), and I get annoyed when I need something else (e.g. Fidelity only offers Symantec, Steam only offers Steam Guard, etc).

[–] [email protected] 12 points 1 year ago

Get a hardware 2FA key instead of using your phone for TOTP

[–] [email protected] 6 points 1 year ago

You can use KeePassXC to generate the TOTP codes on your PC. With the browser plugin, you can generate the code and fill the textbox with one click when the password database is unlocked.

Sites that don't use standard TOTP for 2FA are a pain in the ass though.

[–] [email protected] 6 points 1 year ago
[–] [email protected] 4 points 1 year ago (2 children)

Authy has a desktop app and syncing across devices

[–] [email protected] 2 points 1 year ago (1 children)

…through a third-party cloud server that you have no good reason to trust. No bueno. Keep sensitive information off the cloud unless you want it to become public.

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

yup, that's the tradeoff, this or reaching for your procrastinating device, but yeah, maybe Bitwarden could be better alternative, now i'm too lazy to migrate + it's paid

[–] [email protected] 1 points 1 year ago

KeePassXC seems reputable, so I guess I'll try to use that when the time comes.

[–] [email protected] 1 points 1 year ago

This! Authy is very very nice. Syncing accounts is a life saver, both as backup, and not having to pick up the phone all the time.
Cut and pasting with a click instead of reading and typing, is so much faster.
Easily search the very long list of entries.
Not open source tho, but free as in beer.
If Aegis had the sync option, i would have used that. But it did not last time i checked.