But when I try to log in, they give no indication of which one I have to use.
So I finally started annotating which one in my password manager, so it's a whole extra step to load up that as well, and then search for the app on my phone.
Except it's worse: both the Google and Microsoft authenticators are just named "Authenticator", identically. At least the Google icon is a "G", but the Microsoft icon is so generic it could literally be any company. And then the Symantec Authenticator is randomly called "VIP Access", with zero indication it's by Symantec or that it's even an authenticator.
And because I only use these things once a month or so, I'm re-baffled by it every time.
But in any case, what I wanted to let you know is that you can convert the Symantec VIP token into a standard TOTP token.
Also Square Enix though they have started letting you set up third party authenticators, I just haven't migrated yet.
Then 10 or so accounts in Aegis for general 2fa (including both Microsoft and Google, it has to be said)
There are other ways to do it that don't require using Python and the Steam API by using Steam's desktop application, but since this is HN I find this the most interesting.
But outside of work, all my personal TOTP codes are consolidated.
I really wish I could use Aegis for all of it, but I wouldn't want to use Authy for all of it.
Because whenever I'd sign up or they'd add it as a requirement, they'd always link to a specific authenticator app to use.
Is that just a suggestion rather than a requirement?
[1] https://datatracker.ietf.org/doc/html/rfc6238
[2] https://www.iana.org/assignments/uri-schemes/prov/otpauth
Although now that I'm researching it, it's even more convoluted. I'd installed the Symantec VIP Access authenticator app, for example, specifically because PayPal had said they required it (or the wording had led me to believe that -- they certainly didn't mention alternatives).
But now apparently it's the opposite -- as of this past June, PayPal has removed support for Symantec, and requires instead Google/Microsoft/Authy/etc.:
https://www.paypal.com/us/smarthelp/article/what-other-2-ste...
What in the actual hell. I swear to god there's no winning here. :S
[1] https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... (expired cert warning)
But honestly: If the "remember this session" button is checked as it often is for apps and sites, you should only have to do it every once in a while. Or, if the site is a bit more clever, you may only have to 2FA on sensitive screens, such as "edit personal data" or "make purchase" or "transfer money".
The nice thing about "non-push" TOTP is that it does not require any external service. A site could generate its own TOTP keys, show you a QR code and let you use any app (Authy, 2FAone, Google Authenticator, etc) to manage those codes. And your phone can be offline and still work with it, and you can back up your own 2FA keys.
"Push" based 2FA requires a service, typically paid, like Okta or RSA.
Every time you change device or browser, for many services when you change your IP country, and many services limit the amount of remembered device sessions meaning you basically have to do it every day. Multiply by the number of services that force 2FA. Pray your VPN behavior or travel did not get you some hidden red flag.
The point is that it places a requirement on the user and interrupts their workflow when they just want to Get Stuff Done. And if it stops working then the burden is on the user to make it work again.
TOPT is the least worst way of doing 2FA.
I wish I lived in a world where this sort of thing wasn't necessary, but if you have a service where there are accounts that are worth a lot of money in the real world, you need to have some kind of 2FA.