# I hate, hate, hate two-factor verification **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [March 28, 2023, 11:41pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811 "2023-03-28T23:41:17Z")\ **Posts on this page:** 17\ **Page:** 3
**Author:** ![Wolf333](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf333/32/3460_2.png) [@Wolf333](https://boards.straightdope.com/u/Wolf333)\ **Post date:** [March 30, 2023, 10:17am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/41 "2023-03-30T10:17:54Z")
It it’s a newer device, it has a Trusted Platform Module (TPM). As MFA can be something you have, something you know, or something you are, the TPM+fingerprint counts as two factors. ---
**Author:** ![squeegee](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/squeegee/32/14537_2.png) [@squeegee](https://boards.straightdope.com/u/squeegee)\ **Post date:** [March 30, 2023, 10:20am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/42 "2023-03-30T10:20:26Z")
> [@pulykamell](#): > > Well, I get asked all the time. I just tried logging into iCloud to check and it made me login from scratch, showed me a little map of where my login attempt was coming from, asked me to click “verify” on it, then sent me a 6-digit passcode to use as two-factor authorization. > > This is after I constantly have clicked on “trust this browser” after confirming my login details. It’s been this way for years. Seems after a little while of not logging into iCloud (I normally only log in to find my Phone or my kids’ iPad, but that’s once every two weeks maybe.) I can’t just stay logged in or have it remember this device and browser so I don’t have to jump through a bunch of hoops to get in Yes, this is a problem with iCloud in a browser, as opposed to using the Mac apps (Photos, Calendar, Notes, etc) directly. The damned browser authentication resets all the damned time (“trust this browser”) and you have to have your browser plus an Apple device to authenticate it. It sucks. I run into this because my main desktop machine is Windows, so the only way to get to my phone apps on desktop is via the browser. ---
**Author:** ![Telemark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telemark/32/372_2.png) [@Telemark](https://boards.straightdope.com/u/Telemark)\ **Post date:** [March 30, 2023, 1:48pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/43 "2023-03-30T13:48:47Z")
> [@crazyjoe](#): > > we used to have to carry these little fobs around with an LCD that would randomly generate a new 6-digit code every 60 seconds. My company makes those. The market has moved away from physical to virtual tokens, mine is on my phone. Some companies still use physical tokens for hardened applications, but the same technology exists in virtual space. ---
**Author:** ![ratatoskK](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ratatoskk/32/2987_2.png) [@ratatoskK](https://boards.straightdope.com/u/ratatoskK)\ **Post date:** [March 30, 2023, 4:36pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/44 "2023-03-30T16:36:46Z")
I find it inconvenient, because I am not joined-at-the-hip to my phone, but I view it as a necessary evil. Maybe someday they’ll replace numeric codes with iris scans. Not sure I would like that, either. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 30, 2023, 4:38pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/45 "2023-03-30T16:38:03Z")
Facial or fingerprint scans are already in use. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [April 13, 2023, 11:03pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/46 "2023-04-13T23:03:46Z")
2FA is nearly security theater. Depending on the type of messaging used, the security level runs from “not as good as it should be” to non existent. A family member couldn’t transfer their old phone number to their new phone for … reasons. Got locked out of their Google account and a bunch of other things. Took a week to get it somewhat straightened out. 2FA is a really poorly thought out idea. ---
**Author:** ![Telemark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telemark/32/372_2.png) [@Telemark](https://boards.straightdope.com/u/Telemark)\ **Post date:** [April 13, 2023, 11:44pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/47 "2023-04-13T23:44:47Z")
> [@ftg](#): > > 2FA is a really poorly thought out idea. No, 2FA is an excellent idea. Certain implementations of 2FA suck. ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [April 14, 2023, 12:47am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/48 "2023-04-14T00:47:56Z")
> [@ftg](#): > > 2FA is nearly security theater. Depending on the type of messaging used, the security level runs from “not as good as it should be” to non existent. Good 2FA (or more properly Multi-Factor Authentication or MFA) is proven to reduce the likelihood of being compromised by a factor of 100 for a targeted account e.g. a high-value hack. It probably protects the average Joe by x1000. Microsoft Authenticator on my phone requires number matching on a push alert AND a biometric. Takes about 5 seconds starting with my phone in my pocket. ---
**Author:** ![hogarth](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hogarth/32/1773_2.png) [@hogarth](https://boards.straightdope.com/u/hogarth)\ **Post date:** [April 14, 2023, 1:02am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/49 "2023-04-14T01:02:30Z")
> [@FinsToTheLeft](#): > > Takes about 5 seconds starting with my phone in my pocket. How long does it take without your phone? ---
**Author:** ![FinsToTheLeft](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finstotheleft/32/2930_2.png) [@FinsToTheLeft](https://boards.straightdope.com/u/FinsToTheLeft)\ **Post date:** [April 14, 2023, 1:17am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/50 "2023-04-14T01:17:51Z")
> [@hogarth](#): > > How long does it take without your phone? There are alternate verification methods, but the normal answer is you can’t. I own an IT consulting firm focusing on cloud solutions. My credentials can access hospitals, customs brokers, manufacturers, and banks. I’d be uninsurable if I didn’t use MFA. ---
**Author:** ![Wolf333](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf333/32/3460_2.png) [@Wolf333](https://boards.straightdope.com/u/Wolf333)\ **Post date:** [April 14, 2023, 9:57am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/51 "2023-04-14T09:57:32Z")
Many sites that require MFA will allow you to set up multiple factors. I have 10 on my personal Office 365 account (I like testing stuff). For Google I can use any device that is already signed into the Google app - I can even use my digital audio player. While some of the issues with MFA are due to poor implantation (see below), much of it is do to people just being pretty whiny. \*A site that I need to log into for one of our clients requires MFA, but only allows Okta authenticator and SMS (it did at least allow 2 separate factors). The thing is, there is no way to change it once it is set up. The also requires me to authenticate twice, for some reason. THen again, the software is also pretty crap, so I should not expect more. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [April 14, 2023, 10:04am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/52 "2023-04-14T10:04:49Z")
> [@Telemark](#): > > 2FA is an excellent idea. Certain implementations of 2FA suck This. One example that comes to mind: the bank where I have one of my credit cards has the login set up with the standard “name and password”, immediately followed by “password (again) and code texted to your phone”. I’m not sure what purpose requiring people to type their password twice serves, except to train people to use shorter and simpler (and thus less secure) passwords… ---
**Author:** ![minor7flat5](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/minor7flat5/32/258_2.png) [@minor7flat5](https://boards.straightdope.com/u/minor7flat5)\ **Post date:** [April 14, 2023, 2:29pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/53 "2023-04-14T14:29:12Z")
A few months back I bought a couple of Yubikeys, all excited about switching from the terrible SMS-based 2FA to using something much more secure. Then I discovered that none of the financial institutions I deal with support them. They don’t even provide a code-generation token, like _every other business online_. At least I know my email account is secured by the Yubikey, and that’s a pretty important one to lock down. I also locked down my password safe–can’t log into it on a new device without the key. ---
**Author:** ![Dkale](https://avatars.discourse-cdn.com/v4/letter/d/6f9a4e/32.png) [@Dkale](https://boards.straightdope.com/u/Dkale)\ **Post date:** [December 18, 2023, 5:19pm UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/54 "2023-12-18T17:19:37Z")
I also hate it. B/c I don’t always want to keep my damn phone on me. ---
**Author:** ![jtho2607](https://avatars.discourse-cdn.com/v4/letter/j/e47774/32.png) [@jtho2607](https://boards.straightdope.com/u/jtho2607)\ **Post date:** [June 6, 2025, 8:19am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/55 "2025-06-06T08:19:29Z")
I was a systems administrator for about 10 years. spent another 10 years programming. I had to administer security for our systems. I judged by the audience what to apply. If it was receptionists answering phones and publishing the university blog page, I expressly did not enforce large complex passwords that had to be changed every month. Why? Because if you did that, they would write their password on a post it note and stick it to their monitor. In the hands of an intelligent administrator who addresses his audience and use case will be good security. But the individual employee is becoming more and more rare, because why pay a person when you don’t have to!. Bad Security isn’t about security these days. HTTPS encryption/decryption protocols being depreciated were not about security. it was about Apple and Microsoft depreciating the browser you were using, so then they could force you to buy a new computer when you find the latest operating system does not work on your computer… ---
**Author:** ![jtho2607](https://avatars.discourse-cdn.com/v4/letter/j/e47774/32.png) [@jtho2607](https://boards.straightdope.com/u/jtho2607)\ **Post date:** [June 6, 2025, 8:20am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/56 "2025-06-06T08:20:59Z")
Actually, it would work, but they have written in the install program NOT to install the software on an old computer. ---
**Author:** ![scudsucker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scudsucker/32/14101_2.png) [@scudsucker](https://boards.straightdope.com/u/scudsucker)\ **Post date:** [June 6, 2025, 10:14am UTC](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811/57 "2025-06-06T10:14:37Z")
> [@Mean\_Mr.Mustard](#): > > I’m still bitter that we now have to dial an area code when making a local phone call. I know this a response to an ancient thread, but more anciently, my parents made me memorise our phone number when I was about 4 or 5. 3915 That’s it. I don’t know the area code, I assume my parents never thought that I might wander far enough to need one. 2FA is really standard in my field, web software development. We use a variety of “auth” phone apps, it becomes very seamless once one gets used to it. Now [Previous page](https://boards.straightdope.com/t/i-hate-hate-hate-two-factor-verification/981811.md?page=2)