I’ve been going through updating all of my accounts (passwords, 2FA, etc.), and I’ve noticed that there are a lot of sites that don’t offer any form of MFA.
I can understand smaller services that might not have the bandwidth, but surely larger organisations are able to get this setup?
The worst here are financial institutions. What do I want the most security on? My money.
I get that they have regulations, but it annoys me all the time.
The worst part of those is when they do support 2FA, but it’s text-only. No app authentication or hardware key option.
Like it’s something, but it’s easily the least secure option, and probably the most expensive since it requires operating an additional SMS portal for those codes.
This one I can understand, if something somehow goes wrong with your 2FA you’re locked out of your money
Not if you can walk into a branch.
Not every financial institution has brick and mortar locations.
I know, which is why I said IF.
No you’re not?! You seriously think the bank would just say “nope. No 2FA you’re fucked all your monies are ours now”.
its not even about bandwidth… its about cost to implement over the risk to not implement.
the big big buys have implemented as they helped define the mfa processes we all use. the new, smaller players have implemented because there are easy to implement libraries/services all over (for example, my tiny fediverse instance offers mfa)
the middle tier just havent gotten around to it, or do not see a direct benefit to doing so.
It’s also a pain in the ass for the user. Creating a barrier to entry decreases the likelihood that your customers will use the service. I don’t want to go find my phone to receive a text every time I want to log in to every single website.
It’s not like it has to be required.
Pain in the ass, not really.
Text based MFA is the least secure option, and shouldn’t be used. Apps or a dedicated hardware token are the options you want, and those are pretty easy to setup.
That also doesn’t even take into account that mobile makes up more than 50% of global web traffic now. So “going to find your phone”, you are in the minority. The majority of people are already using their phone when they are logging into something.
A dedicated authenticator app like Authy is easy to set up. And now the most common password managers also allow generating those MFA app codes directly to login with them alongside your regular username and password. Apple’s Keychain, LastPass, and Bitwarden all support it, just to name a few.
And we have Passkeys being implemented as an alternative to the Password/2FA system, with native support for that via things like iOS and Bitwarden, and I’m sure others as well.
You’re ignoring the part about having to go find your phone. MFA apps still require you to do that.
My second paragraph literally points out that the majority of Internet traffic now is mobile, around 58%. More likely than not, any given person is already on their phone. No need to find your phone when it’s in your hand and you’re already looking at it.
Because they don’t feel like it and aren’t required to
Just copy paste that for literally any “why aren’t more companies doing (X thing that makes sense and better protects the consumer)?” questions.
- it takes engineering time which is not a trivial cost - accounts and identity for large orgs tend to be a lot more complex than you might think - there will likely be a few different identity stores, and multiple systems that query those stores; making sure every possible permutation works correctly can be a bit undertaking
- It adds additional load to their support teams which is very expensive
The support one is a real killer for a lot of places; I’ve worked with a place that had a few million paying customers, and ~half of those were in a tier where a single 30 minute support call would completely negate any revenue that that customer would bring in for the year. Email support was slightly less expensive, but would still be a significant proportion of your annual profit
https://2fa.directory A directory of common sites that offer (or don’t offer) 2FA, which and how. I agree it should be a default feature. But maybe harvesting your full ID credentials is more juicy to many companies
That’s a super useful site, thank you!
