# I hate, hate, hate two-factor verification **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [March 28, 2023, 11:41pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811 "2023-03-28T23:41:17Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [March 29, 2023, 2:29pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/21 "2023-03-29T14:29:20Z")
> [@beowulff](#): > > I can’t fathom what you are doing. > I **never** have to authenticate with iCloud. Well, I get asked all the time. I just tried logging into iCloud to check and it made me login from scratch, showed me a little map of where my login attempt was coming from, asked me to click “verify” on it, then sent me a 6-digit passcode to use as two-factor authorization. This is after I constantly have clicked on “trust this browser” after confirming my login details. It’s been this way for years. Seems after a little while of not logging into iCloud (I normally only log in to find my Phone or my kids’ iPad, but that’s once every two weeks maybe.) I can’t just stay logged in or have it remember this device and browser so I don’t have to jump through a bunch of hoops to get in. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 29, 2023, 3:07pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/22 "2023-03-29T15:07:44Z")
I haven’t visited iCloud via a browser in a long time, so I just tried it. Safari asked if I wanted to log in with Touch ID, I said yes, and was immediately logged in, with no 2FA required. ---
**Author:** ![Jasmine](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jasmine/32/2964_2.png) [@Jasmine](https://boards.straightdope.com/u/Jasmine)\ **Post date:** [March 29, 2023, 3:20pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/23 "2023-03-29T15:20:21Z")
> [@kanicbird](#): > > We really need something better. They could set it up better! Ours is predicated on the device. Once you sign in with 2-step on your district device and accept the query on your phone, you never have to do it again for that device. If you go home and decide to log in with your desktop/laptop/whatever, you are asked once and, if the query is accepted, you never have to ask again for that device, either. The logic is predicated on the fact that, even if you are hacked, the hacker does not have YOUR approved device, so a query would have to be made and, unless the user is a complete idiot, would subsequently be rejected and a report made by the user. The only way to defeat that would be for a hacker to hack your account, figure out who you are, stalk you, and mug you for your device. I have a feeling we’'d be bright enough to disable the login for that device within 60 seconds of that highly unlikely possibility. LOL Much of what I’m reading here is, not to be indelicate, complete bullshit. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 29, 2023, 3:24pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/24 "2023-03-29T15:24:59Z")
There’s 2FA and there’s 2FA… The cheap-and-dirty “send an SMS to a device” 2FA is not very secure, and can be defeated by SIM cloning. The much better, but not nearly as well supported 2FA requires an app to generate a time-stamped passcode. This is much harder to defeat, since the app’s passcode seed is tied to the device - just cloning the SIM to another phone won’t work. Apple supports this in iOS, without requiring a separate app, but the steps required to get the passcode are not very user-friendly. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [March 29, 2023, 3:41pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/25 "2023-03-29T15:41:59Z")
My desktop does not have touchID. Of the six Macs I have, only the laptop bought last year does. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 29, 2023, 3:44pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/26 "2023-03-29T15:44:13Z")
I’ll have to check on my older machine… ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 29, 2023, 4:20pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/27 "2023-03-29T16:20:35Z")
OK, I just tried it on my ancient 2011 MacBook Pro running High Sierra. I went to [iCloud.com](http://iCloud.com) using Safari. My Apple ID and password were auto-filled by Safari, Apple sent a code to that machine, which I had to type in, and that was that. ---
**Author:** ![crazyjoe](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@crazyjoe](https://boards.straightdope.com/u/crazyjoe)\ **Post date:** [March 29, 2023, 4:36pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/28 "2023-03-29T16:36:03Z")
Before there was the phone, we used to have to carry these little fobs around with an LCD that would randomly generate a new 6-digit code every 60 seconds. Then, when you logged in, you were prompted for that code. I am thrilled that I can just use DUO now. Yes, I have to pay more attention to my phone. But holy fuck, it’s a $1000 piece of hardware. You better believe I pay attention to it. I dropped it once and broke the screen, which was awful and I had to do an expensive same-day repair. It’s in a much more secure case with a screen protector now. Phones and stupid people are the reason for 2FA. Instead of following best practices for passwords (don’t re-use, make them complicated and long) people opted for being lazy because it’s hard to memorize and type complex passwords on a phone. ---
**Author:** ![ISiddiqui](https://avatars.discourse-cdn.com/v4/letter/i/97f17d/32.png) [@ISiddiqui](https://boards.straightdope.com/u/ISiddiqui)\ **Post date:** [March 29, 2023, 5:05pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/29 "2023-03-29T17:05:52Z")
> [@wolfpup](#): > > You know who’s really laid back about security and rarely bugs me about anything? My bank. Which really understands security, but also knows how to be unobtrusive and non-obnoxious about it. I am beyond annoyed that my bank will only use text messaging for 2FA which is the most insecure form of it. I have an authenticator app (I use Authy) that I use for 2FA - where I can place my 2FA for things like Reddit and Twitter, but my massive bank can’t be bothered, smh. I love 2FA. It provides an additional layer of security and I don’t have to worry about someone figuring out my password and then getting in. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [March 29, 2023, 5:17pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/30 "2023-03-29T17:17:08Z")
I also had to click an “allow” along the way, but what’s the freaking point of having a “trust this browser” option if I have to go through this circus every time? (Or it resets after a period of time.) I just want to be logged in with the auto-fill. ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [March 29, 2023, 7:42pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/31 "2023-03-29T19:42:07Z")
I heartily endorse this pitting ---
**Author:** ![kanicbird](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@kanicbird](https://boards.straightdope.com/u/kanicbird)\ **Post date:** [March 29, 2023, 10:45pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/32 "2023-03-29T22:45:13Z")
> [@Jasmine](#): > > he only way to defeat that would be for a hacker to hack your account, figure out who you are, stalk you, and mug you for your device. This is what is happening. People are being watched to see what their passcode is, then their phone snatched. In about 2-3 minutes their Apple ID has been changed (as all you need is your passcode) and they are locked out of their device + the thief has access to all passwords saved to the device, typically clearing out their accounts. ---
**Author:** ![hogarth](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hogarth/32/1773_2.png) [@hogarth](https://boards.straightdope.com/u/hogarth)\ **Post date:** [March 29, 2023, 10:45pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/33 "2023-03-29T22:45:39Z")
> [@Chronos](#): > > It’s stopping the attacks that are the big danger. It’s not telling you about stopping those attacks, because it stopped them before they even got to that point. OK, I get it; it’s like automobile immobilizers keeping away “casual” car thieves. I still find it annoying that it (seemingly) has to be done through a cell phone, though. But presumably most 2-factor methods must have a backup method to use when the phone itself is lost, yes? ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 29, 2023, 10:46pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/34 "2023-03-29T22:46:29Z")
Who enters a passcode on an iPhone these days? ---
**Author:** ![kanicbird](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@kanicbird](https://boards.straightdope.com/u/kanicbird)\ **Post date:** [March 29, 2023, 10:54pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/35 "2023-03-29T22:54:29Z")
While is it reduced, it is still needed at times. ---
**Author:** ![carrps](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carrps/32/2957_2.png) [@carrps](https://boards.straightdope.com/u/carrps)\ **Post date:** [March 29, 2023, 10:56pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/36 "2023-03-29T22:56:55Z")
> [@crazyjoe](#): > > Before there was the phone, we used to have to carry these little fobs around with an LCD that would randomly generate a new 6-digit code every 60 seconds. Then, when you logged in, you were prompted for that code. Wow. I completely forgot all about those! ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [March 29, 2023, 11:01pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/37 "2023-03-29T23:01:30Z")
I use my passcode almost every day when the Face ID doesn’t quite recognize me or is taking too long. That’s only like 10% of the time, but I find I use my passcode quite a bit. ---
**Author:** ![hogarth](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hogarth/32/1773_2.png) [@hogarth](https://boards.straightdope.com/u/hogarth)\ **Post date:** [March 29, 2023, 11:18pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/38 "2023-03-29T23:18:39Z")
> [@beowulff](#): > > Who enters a passcode on an iPhone these days? I do it every time my wife asks me to take a picture of her (with her iPhone). ---
**Author:** ![Richard\_Pearse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/richard_pearse/32/13144_2.png) [@Richard\_Pearse](https://boards.straightdope.com/u/Richard_Pearse)\ **Post date:** [March 30, 2023, 4:53am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/39 "2023-03-30T04:53:09Z")
> [@crazyjoe](#): > > Before there was the phone, we used to have to carry these little fobs around with an LCD that would randomly generate a new 6-digit code every 60 seconds. Then, when you logged in, you were prompted for that code. I bank with a bank that still does that (Rabobank). I have a physical device that I have to enter my code and then a number and then put the code in. I bank with another bank, (HSBC), who’ve recently moved to the same system (after using a physical) but on your phone, so I open the app on my phone and it has the code to input. Better than having a physical device, but it still sucks. I’ve never had any particular issues with iCloud and have only just purchased a keyboard with fingerprint technology. My employer’s setup is pretty good to be honest. It uses Microsoft and I only seem to have to use the authenticator app once per device. > [@Spoons](#): > > Exactly. My bank has allowed me to keep the same password for twenty years, without telling me that it has to be “seven characters, one of which is a capital letter, and two of which are numbers.” Oh, and a suggested safe password is “sje24&%#bheS2Eth,” or some Goddamn thing that nobody could possibly memorize. Naturally, my accounts are insured by CDIC. This isn’t Fort Knox, people! This is because your password is only protecting the few thousand dollars that you have in your account (could be more, could be less, but it’s probably small cheese comparatively speaking) and the bank doesn’t particularly care about it. I bet the bank’s own corporate security is much more involved. ---
**Author:** ![Mean\_Mr.Mustard](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mean_mr.mustard/32/3865_2.png) [@Mean\_Mr.Mustard](https://boards.straightdope.com/u/Mean_Mr.Mustard)\ **Post date:** [March 30, 2023, 9:24am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/40 "2023-03-30T09:24:51Z")
I’m still bitter that we now have to dial an area code when making a local phone call. mmm [Previous page](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811.md?page=1) [Next page](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811.md?page=3)