List of websites and whether or not they support 2FA
twofactorauth.org
twofactorauth.org
(FD: I wrote it)
Yes, I've said it - if you leave an open Spotify running somewhere, someone can walk by and takeover your account.
What!? Without any verification or corroborating proof of me being the account holder? This is really shady.
If your argument is that phone based 2FA is no good because it's vulnerable that'd count for TOTP as well, which is vulnerable to live phishing attacks that are now relatively widespread. In both cases they're a lot better than nothing.
His account was hijacked because his phone number was a single factor.
Does this mean those applications are ipso facto vulnerable, via a similar attack vector?
Email is hard to hack (you need a password, and possibly a second factor if the email account is properly secured).
Phone numbers are easier to spoof using SIM swapping. See https://www.theverge.com/2019/8/31/20841448/jack-dorsey-twit...
HN ranks pretty highly, and we're a "niche" community.
Are you saying only the top 200K sites are important enough to warrant 2FA at all?
A site like this would be great if it included columns for other security features so I can see whether they take security seriously overall.
Its unfortunate that they don't have this information. I would switch services to a site that specifically supports U2F/FIDO/FIDO2 but not to a site that uses a random proprietary hardware token that is still vulnerable to phishing.