• nogooduser@lemmy.world
    link
    fedilink
    English
    arrow-up
    13
    arrow-down
    1
    ·
    11 hours ago

    App based 2FA is better. Either the app generates a time based code that you enter into the site or the site sends a push notification to the app asking you to verify the login attempt.

    Passkeys are good too as they replace the password completely and leave the 2FA part to the device.

      • Opisek@piefed.blahaj.zone
        link
        fedilink
        English
        arrow-up
        4
        ·
        9 hours ago

        If it’s alright with your threat model, you can put the time-based OTPs into your password manager of choice, like Bitwarden. Upon filling your username and password, it places your OTP in your clipboard, so that you can simply paste it in. This does of course reduce the security of the system slightly, since you centralize your passwords and your OTPs. When opting for this method, it is therefore imperative to protect your password manager even more, like via setting up 2FA for the password manager itself or making sure your account gets locked after something like 10 minutes of inactivity. The usability aspect is improved by using a yubikey or another similar physical key technology.

        • Victor@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          8 hours ago

          Very good point. I have Bitwarden set up as a passkey for at least one account. I should remove that. 👍

      • nogooduser@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        5 hours ago

        You don’t for the one time codes because there is a standard that is supported by many authenticator apps.