undefined | Better HN

0 pointsrsync4y ago0 comments

Show me a TOTP implementation that doesn’t require a phone number to sign up for or initialize…

IME, they not only require a phone number at setup but, further, reject VOIP/twilio numbers.

This shows that it’s not at all about security, but about slowing (but not solving) their brutal, unrelenting, spam and sock puppet problems.

EDIT: Thanks - very interesting. I guess I am jaded by my experiences with 'authy' and twilio, etc.

0 comments

3 comments · 2 top-level

roblabla4y ago· 1 in thread

TOTP never requires a phone number. On GitHub, they either show you a qr code you can scan in an app, or a text you can import. All apps support this sign up process, from google authenticator to console-based tools like totp[0].

Other 2FA implementations may require phone numbers. But HOTP and TOTP don't.

[0]: https://github.com/arcanericky/totp

istillwritecode4y ago

TOTP itself doesn't require a phone number, but the Authy phone app from Twilio managed to screw up their TOTP implementation and it requires a phone number. I filed a bug with them and they finally acknowledged that it's deeply embedded in their implementation.

vel0city4y ago

Well, for starters, Github. I don't have a phone number on file with them and I have TOTP and FIDO available.

The vast majority of sites I use TOTP on didn't require a phone number for the account.

j / k navigate · click thread line to collapse