This is something I am seeing more and more of. As companies start to either offer or require 2FA for accounts, they don’t follow the common standards or even offer any sort of options. One thing that drives me nuts is when they don’t offer TOTP as an option. It seems like many companies either use text messages to send a code or use some built in method of authorizing a sign in from a mobile device app.
What are your thoughts on why they want to take the time to maintain this extra feature in an app when you could have just implemented a TOTP method that probably can be imported as an existing library with much less effort?
Are they assuming that people are too dumb to understand TOTP? Are they wanting phone numbers from people? Is it to force people to install their apps?
*edit: I also really want to know what not at least give people the option to choose something like TOTP. They can still offer mobile app verification, SMS, email, carrier pigeon, etc for other options but at least give the user a choice of something besides an insecure method like SMS.
I can’t answer your question but it’s particularly annoying for me because I travel a lot for work. Sending me an SMS message when I’m in the middle of Africa isn’t going to work. (In fact I found a way to make it work by enabling wifi calling with my US cell provider… but I shouldn’t have to jump through hoops to verify my identity)
I also used to run into this when flying for work I would have paid for wifi on a plane flight but my mobile device isn’t able to get their text or push notification because I only paid for my laptop to have wifi. Used to drive me crazy and then I just stopped working while on flights because of dumb policies.
That’s why you use an Authenticator app that gives you TOTP offline.
If a service you use does not offer TOTP but implements their own 2FA through another method, you have no choice to use it though.
That’s exactly what this thread is about. When companies don’t provide that as an option.