Recent examples Twitch and Firefox 🤦
Facebook not only sends the code to text without asking, but they love to just directly start the reset password procedure.
Now, that’s super weird. Are they assuming that, because last time I logged in was 6 months ago, I must have forgot my password?
Steam not having 2fa generator feature:
I love mandatory sms
My guess is that it’s the easiest and cheapest way to set up “MFA”.
The number of banks that don’t have proper MFA really bugs me.
My guess is that it’s the easiest and cheapest way to set up “MFA”.
TOTP is cheaper.
SMS is actually expensive at scale. An example would be Signal, the messenger app that doesn’t use SMS. They have overhead for sending backup codes/new account creation/Verification/etc… https://www.wired.com/story/signal-operating-costs/ 6 million a year. API integrations for SMS messages/codes are still like 1-5 cents per message.
TOTP’s requirements? A reasonably accurate clock on the server, and storing the shared secret in a database.
