This is something I am seeing more and more of. As companies start to either offer or require 2FA for accounts, they don't follow the common standards or even offer any sort of options. One thing that drives me nuts is when they don't offer TOTP as an option. It seems like many companies either use text messages to send a code or use some built in method of authorizing a sign in from a mobile device app.
What are your thoughts on why they want to take the time to maintain this extra feature in an app when you could have just implemented a TOTP method that probably can be imported as an existing library with much less effort?
Are they assuming that people are too dumb to understand TOTP? Are they wanting phone numbers from people? Is it to force people to install their apps?
*edit: I also really want to know what not at least give people the option to choose something like TOTP. They can still offer mobile app verification, SMS, email, carrier pigeon, etc for other options but at least give the user a choice of something besides an insecure method like SMS.
I think it’s because TOTP requires some sort of initial token sync that is more complicated than entering a telephone number. There’s also no need to have people backup codes etc. To use Authy for example I need to photograph a QR code and have a smart phone.
Text message as a solution works on older non-smart phones so it’s possibly the “most widely accessible” solution.
From a backend perspective as well it’s just an API text $random to $phone.
TOTP is much easier to implement on the backend. No API required, just generate a few codes yourself and check if the user gave you one of them (multiple codes to provide a time window).
You have to configure the users device at the start to give you your own codes back…
That’s just a secret, like a password. If you can save their password, you can save their TOTP secret. For the user, they just scan a QR code with their app. They don’t even have to type the code in.