Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In those cases I opt to have no 2FA at all.

Only culprit that's really enforced it is the Canada Revenue Agency



Some services force you to use SMS 2FA.

My bank recently made a 'security' updates and now my Google Voice number no longer works with their text or call 2FA. They provide no other alternatives and I must have it. I have to now call their customer service, wait a half hour to speak to someone, verify my identity, and have them reset in order for me to login.

Thankfully I rarely login to that bank as it's not used for much, but if it goes on for more than 2 months or so - I'll probably switch.


I honestly find 2fa enforcement detremential and it should be entirely possible to opt out - case in point my current bank (not by choice, ridiculous country that can't manage to join the euro) are disabling SMS 2fa for online banking and suggest using their app, except the app doesn't work (they'll still send 3ds via SMS though!!) and they've basically stopped bothering to reply - anyway the point really is that people who are not morons should be able to opt out, because the onus and damage on the end user often outweighs any possible risk of stealing funds etc (there's literally nothing in the account, standing order sends all of my income to a useful bank abroad the day after it arrives).

As an aside, open banking is also a joke as it doesn't allow the end user access to their own account, only 3rd parties - simple API access would make this problem moot, as where I hold my funds grants me API access and I can do things like trigger transfers on webhooks etc, very simple and infinitely useful.


I bank with a local credit union, and their online banking originally only supported SMS. I wrote to them about the many security issues with that, and an executive responded and acknowledged my concerns.

A few months later they added TOTP support. Not sure if I influenced that at all, but it's just another reason why I will only ever use a credit union as my main bank.


As per your last comment, I would likely be changing banks in that scenario, and letting them know exactly why they are losing a customer. Even if it doesn't seem like any one individual making sure that reason is documented, I do think in aggregate eventually it could be enough to make a difference with stuff like this.


Amazon KDP forces to use SMS. And I never received SMS when I tried it. Just removed my short story (nobody was reading it anyway) instead of asking support...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: