Mother fracking 2-factor authentication! I understand the security risks and the benefits. I'm actually happy to have the extra security on this account, as it's a pretty important account and if it was compromised it would be really damn inconvenient for me.

That brings us to my rant. FOR THE LOVE OF GOD, IF YOU'RE GOING TO REQUIRE TWO-FACTOR AUTHENTICATON, IMPLEMENT IT SO IT ACTUALLY WORKS!!!!!! I've been trying to log in all morning. I've asked to be sent a one-time login pin FIVE times now via SMS and two different email addresses I have registered. Each pin comes with a 10 minute time limit after which it will cease working. Want to guess how many of those pins have arrived within that 10 minute limit? If you guessed 0 you would be a winner! Fastest one yet came in at 12 minutes, but that's just not gonna work for me. The longest was ~37 minutes and the SMS pins never arrived at all.

Now, you're telling me my password has been suspended because I've had too many failed log in attempts? Screw you, I know my login info. The only reason there was more than one attempt to log in in the first place is because the shitty two-factor authentication you require DOESN'T ACTUALLY WORK!!! Two factor authentication has been around forever and nobody else has a problem with it, so fix your shit.

Yikes!

I routinely get mine via text message in well under a minute. Some offer phone calls too although I've never used that mode.

Is this isolated to just one account? Or many which would indicate a phone carrier issue?

So what entity is this with the broken 2FA?

I've had that happen, even one company that after two weeks still hasn't sent the password reset request email.... some take their time.

We've implemented 2 separate 2FA setups at work.
1 for remote access/VPN users & another for Office365.

Large proportion of users would see the setup instructions for 1 & try to use them on the other.

And, to makes it worse, a lot of our users don't have a company computer, so we have to hand-hold & walk them through it.

Perspective, from the other side.

I don't like needing to get an sms text as 2FA.

I like Amazon that uses a 2FA authenticator and my password manager automatically puts the authenticating number for me.

We use Google Authenticator for VPN 2FA, and O365 2FA is a 1 & done code.

quote:

Originally posted by bald1:
Yikes!

I routinely get mine via text message in well under a minute. Some offer phone calls too although I've never used that mode.

Is this isolated to just one account? Or many which would indicate a phone carrier issue?

One account. Same issue over my cellular and work wired network.

quote:

So what entity is this with the broken 2FA?

Work payroll website.

quote:

We've implemented 2 separate 2FA setups at work.
1 for remote access/VPN users & another for Office365.

Large proportion of users would see the setup instructions for 1 & try to use them on the other.

And, to makes it worse, a lot of our users don't have a company computer, so we have to hand-hold & walk them through it.

Perspective, from the other side.

Yeah, I understand that. I'm about 100% sure this one isn't me because it works, it's just too slow. I'll be on the phone with support for either a hand holding or gripe session later this afternoon anyway though.

quote:

I don't like needing to get an sms text as 2FA.

I like Amazon that uses a 2FA authenticator and my password manager automatically puts the authenticating number for me.

I would prefer something like that as well. 15 years ago I had an account with a separate authenticator. Log in, press the button, and type in the code it gave you. It worked great, but wasn't really practical as it was a separate device you had to carry around with all of those disadvantages.

I don't like 2FA at all. Annoying, occasional glitches, pain in the butt.

I'd just drop it altogether if I could.

I don't like 2FA, either, but, if you ran any Internet-facing servers and saw the intensity of attacks against them, you might not hate it quite so much.

The big problem with SMS-based 2FA is SMS/MMS has no guarantee of delivery time--or delivery at all. The wireless providers really need to step up their game in this respect.

quote:

Two-factor authentication

If I'm understanding what this is correctly, I dumped a big bank over it. I logged into my account and got the message that there was something different about my login (I've had this computer for nine years) and they needed to send me an access code. I opted to have it e-mailed. They sent me the e-mail, but there was no code in it. That was the last straw. I closed the account on my next day off and moved to a local credit union. The most they do is occasionally ask my security question(s). Chase Bank is fond of doing this as well, but I haven't had any such problems with them.

quote:

Originally posted by ensigmatic:
The big problem with SMS-based 2FA is SMS/MMS has no guarantee of delivery time--or delivery at all. The wireless providers really need to step up their game in this respect.

Have to say that the majority (99%) of the 2FA SMS messages I get in a matter of seconds from the click, rarely more than a minute. Could be the provider (ATT) has a good system for SMS and location (large metro area).

quote:

Two-factor authentication

^^^^^^^^^^^^^^^^
Never a problem. The email is immediate. I have this on over ten accounts and it has been succesful. I certainly prefer it over trying to answer stupid security questions.

I recently had to deal with this crap as well. I needed to digitally sign something (another colossally stupid idea), and they kept saying they would send me a 2 factor number by text, except it never got to me. No option for an email or answer questions. It took me 2 days to get this shit to work.

Oh, I understand the need in this day and age, since so many crooks abound. But I too hate having to use it when it doesn’t work correctly. I had set up one for Audible, as I do enjoy listening to books quite a bit, and I don’t have a smart phone. Usually with other required authentications, I would get a text with a number. No, what they didn’t inform me was this would be a link to a web address to enter my authentication. Grrrr.
My cell does have internet capability, but it’s horrible and takes forever.
When I tried the link, it timed out each attempt.
I had to call and promptly switch my authentication to email instead of phone. At least I got that fixed, but I would hate not getting the number within their allotted time frame. Hope you get yours finally fixed!