No and stop using SMS it's not secure.
The least secure part of the sign-in process is the person. It doesn't matter what the 2FA method is.
You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because "they're from Google". Someone can trick you into making the financial transfer yourself because "you're getting a deal".
On some websites, it is the only option.
Although it's true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn't matter. It still is doing it's job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
Many password managers use a biometric factor to sign in (your fingerprint, for example, using some kind of auth app if needed). This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
This is why we require second factor on the password manager too, otherwise youāre exactly right.
Stop using 2fa where its not needed. My university library logs me out every 45 minutes and requires microsoft authentication to log in.
Seriously, whats a hacker going to do if tgey get my password,download a PDF? Send a citation to my Favorites list?
But wait it has to be double secure, it has two s's in its name!!
USPSā website does this, sort of.
If their text service is down itāll let you know and just skip the 2FA process even though normally they offer an option to get the code via email.
The fact that they do this is bad enough, the fact that this happens so often that Iāve seen this at least a dozen times is even worse.
Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
Please just dont do anything you arent supposed to, my boss will kill me
Our authentication system is experiencing difficulty, please just type ADMIN / ADMIN.
The password you have entered is already used by user
RandoMcRandom123, please use another password.
I appreciate the quick hack, but with a little more foresight you could have just put up a blurry jpeg with that number and changed the prompt so it looks like a CAPTCHA. Nobody would have given it a second thought.
