2FA and Cell Phone Experience

[eniacpalm]

More sites are supporting Authenticator Apps so that one does not have to rely on SMS for 2FA. It is more secure as long as you can keep control of your device.

Passkeys are also gaining some traction, maybe they can eventually replace our dependence on passwords and SMS.

second this, an authentication app creates its own code, so you are not relying on receiving a text and are more secure than standard 2fa via text. one grip i have is that schwab is locked into symantec vip, while others (fidelity) will accept other apps such as microsoft or authy. fidelity is toying with passkeys, while schwab is behind.

 

[Aerides]

I would change cell providers after a 2 hour outage. I use Google FI. 2 weeks would have been crazy 20 years ago. Today? That's a weak provider.

2FA "trusted devices" doesn't work anyway I find. Anything I say "remember this/me" I still have to authenticate regularly.

 

[WWDog]

I don't own a cell phone and I don't have these types of problems. A few years ago, all these "convenience" accounts and access to your accounts started up to make more money and "24 hour" access to everything. Just say no! All this "convenience" has created vulnerabilities and added costs to you and/or these companies. Just pull back and say NO!

 

[KarenF]

Makes me wonder if a second internet provider such as Starlink Mini with some sort of emergency solar panel battery might be a good idea. I might justify the cost in my mind as a donation to the Get to Mars project.

Internet providers do not give you a phone number.

 

[KarenF]

I don't own a cell phone and I don't have these types of problems. A few years ago, all these "convenience" accounts and access to your accounts started up to make more money and "24 hour" access to everything. Just say no! All this "convenience" has created vulnerabilities and added costs to you and/or these companies. Just pull back and say NO!

I don’t think ignoring new technology is the solution. I do get 2FA while not at home and travel for periods of time.

 

[MdaPetralia]

2FA "trusted devices" doesn't work anyway I find. Anything I say "remember this/me" I still have to authenticate regularly.

Note it may not be working because the sites cookies were deleted or incognito mode (as cookies are automatically deleted when a browser session ends) was used.

 

[indiajust]

I would seriously consider changing cellphone provider’s after a two week outage. Can you post a link about this ransomware attack?

To better protect your investment accounts, I would switch to a Symantec VIP security token, which costs about $22. There is a link at the top right corner at Symantec VIP Symantec VIP - Two Factor Authentication Anywhere
This is more secure than 2FA on your phone, and doesn’t require a phone to use.

I used this dongle for many years. They slowly drift out of alignment over time and have to be synced, usually on the phone with customer service. But it worked well for years.

 

[indiajust]

I use Symantec's VIP Access phone app for my 2FA wherever I can. That includes my 2 brokerages (Schwab and Fidelity). It is similar to the Symantec security token mentioned above except it is a software (app) solution rather than a physical device. If I lose my phone entirely, I will have to jump through hoops to recover. Finger's crossed that does not happen.

As do I. To supplement Pirates post...

You can add this app to an IPad or even to a computer. The apps communicate via TCP/IP over wifi, not over the cell network. Thus a lost or hacked phone is irrelevant and you will still have a functioning 2FA process available (as long as you have internet access)

Because the 2FA authentication is a hash of both device and user information, the same Symantec VIP app installed on different devices will produce different codes. There can be only ONE!

Most folks use the phone as authentication device since it travels with them.

A less portable approach is to use a single older device for all your authentication service needs, and keep it near the computer you do the logins on. A small old iPad with VIP installed will do the trick.

Many brokerages have standardized on the VIP app, since Symantec has a long history here with dongles and more. I prefer Authy. Between the Authy and VIP, I have about 20 2FA accounts secured. All on IP, not cellular data.

Thus far, I am avoiding google/apple cloud integration services for cell 2FA, which automagically fill in codes for logins. I fear this concentrates power and control which would increase the value of the target, and thus the risks of hacking. I prefer the chinese wall between vip/authy and apple/google.

 

[MdaPetralia]

You can add this app to an IPad or even to a computer. The apps communicate via TCP/IP over wifi, not over the cell network. Thus a lost or hacked phone is irrelevant and you will still have a functioning 2FA process available (as long as you have internet access)

I've recently started using Bitwarden's (TOTP) Authenticator app which does not require internet/Wifi access to generate 2FA codes.

Because the 2FA authentication is a hash of both device and user information, the same Symantec VIP app installed on different devices will produce different codes. There can be only ONE!

One of the reasons why I choose Bitwarden's Authenticator app is because it will generate the same 2FA codes on different devices. That way if my Android phone is not accessible, I can use my wife's iPhone as a backup to access the same codes.

 

[TheWizard]

I would change cell providers after a 2 hour outage. I use Google FI. 2 weeks would have been crazy 20 years ago. Today? That's a weak provider.

2FA "trusted devices" doesn't work anyway I find. Anything I say "remember this/me" I still have to authenticate regularly.

I also use Google Fi, but I wonder which carrier they use in "the North woods of Wisconsin".
It would be T Mobile when available...

 

[Sunset]

I don't own a cell phone and I don't have these types of problems. A few years ago, all these "convenience" accounts and access to your accounts started up to make more money and "24 hour" access to everything. Just say no! All this "convenience" has created vulnerabilities and added costs to you and/or these companies. Just pull back and say NO!

So how do you pay bills when you are away from home for a month or two ?

I would say online access has reduced costs for companies like banks, as in the old days they used to pay a teller to manually deal with customers coming in to pay bills, or get a bunch of checks and cash from a company that they would credit to the company account. Now it's all online and no teller's needed.

If you don't have an online account at the bank, someone could sign up in your name for one, they just need information that is already floating around the internet. You won't even know they are trying to do it.

 

[Koolau]

So how do you pay bills when you are away from home for a month or two ?

I would say online access has reduced costs for companies like banks, as in the old days they used to pay a teller to manually deal with customers coming in to pay bills, or get a bunch of checks and cash from a company that they would credit to the company account. Now it's all online and no teller's needed.

If you don't have an online account at the bank, someone could sign up in your name for one, they just need information that is already floating around the internet. You won't even know they are trying to do it.

What we have noticed is that, while everyone wants you to interact with them via the internet, they DO want your money bad enough that they actually have phones and people to take your payment over the phone. I'm sure they don't like it, but they like your money well enough to make that option available.

We even pay bills by (wait for it) snail mail and check.

But, full disclosure, we DO have a cell phone (two of 'em) but we don't use them to interact via the net. We use them for (wait for it) phone calls (and the occasional text).

Luddite? You decide.