sms notification /2FA via sms on user login
tracked
Mr Quack
well as in topic i think 2FA option via sms may be not much safe in some cases but its better because example if something go wrong with app, android/iphone got broke, simple lose phone, or let it dive into water its done (it happen all time),and what then never can got back account (or well at last its hard) via sms is simple go to provider store give id and ask for got sim card back, its simple and easy, also not all use smart phones, smart anyhing so why not...
about notification via sms well someone say not need but i think nice option when i last time login to email releated to my avi next to never (do u?) , also it allow faster reaction if something bad happen (god please not but..)
so this is my to ideas hopefully u may like it...
as always sorry for my bad english..
hugs,
Quack.
Log In
Lettie Linden
Merged in a post:
More and better security systems for our accounts
Kira Balestra
I've always had MFA enabled since we got the option to have it and I've never had any problems since we got access to MFA, but all last week I had constant problems since neither the SL website nor any of the SL viewers would accept my authentication app tokens... I reinstalled several times, cleared cache everywhere, changed authenticator apps several times, tried other web browsers... and nothing worked on the web or the viewer, in the end I had to remove that option from my account... and I haven't tried again because I got fed up with not being able to work in peace.
It would be great to have an authentication system or more security options that are really reliable
I don't currently trust Second Life's MFA, but I also don't like having my account with just a password and nothing else.
Lettie Linden
Merged in a post:
Alternate 2FA Access for accessibility
Linn Darkwatch
Currently, 2FA for SL means using a service to copy and re-type a six-digit code within 30 seconds. While this is sufficient for many, 30 seconds is simply not long enough for some people with vision or movement difficulties.
I suggest allowing alternate methods of 2FA authentication, such as sending a (longer-time limit) link to SMS and the use of backup codes. This would encourage those who do not use it now due to the aforementioned difficulties to make their SL more secure, and would have the added benefit that if someone's phone is lost or broken, they would still be able to access SL.
Lettie Linden
Merged in a post:
More MFA options
Leo Mercury
We need more MFA options. It can't that Authenticator apps are the only option.
We should be able to setup our phone numbers or email addresses as a second method.
This can also be used as a recovery option.
primerib1 Resident
The TOTP standard actually allows 2 things to help people:
- Custom time period; the _default_ is 30 seconds, but can be customized
- Time slew; the server-side verifier _can_ be configured to accept up to "N" previous/after codes. Say, "N" is "3", that means the verifier will accept the current code, previous code, the code before that, and the code before that.
#1 is _sometimes_ not supported by the TOTP code generator; but #2 should be easy to implement:
- Grab current timestamp (UTC), floordiv by period (30), calculate
- Decrease the floordiv result by 1, calculate
- Repeat step 2 up to N times
- Repeat step 2, but with increment, up to N times
- You'll end up with (2N+1) codes. Check that user entered one of them.
Most freely-available TOTP libraries already have the "slew" feature built-in, though the "N" usually defaults to "0"; just customize this value.
Fionne Burleigh
I agree. Between my own disabilities and current vision issue having only 30 seconds before the Google Authenticator switches to another is a bit of a challenge. However, I would imagine that's something to address with Google.
Linn Darkwatch
Fionne Burleigh Yeah, Google Authenticator won't change its allotted time. But other sites do allow the use of pre-generated backup codes, which would get around that issue.
Logan Elf
Backup codes are useful in case the 2FA device is unavailable -- I have them from a few other sites.
Wicked Nightfall
One of the most important things - our account safety and once again Linden Labs shows they could care less about it.
Here is a request - find better leadership for this company as the current leadership sucks and needs to be replaced.
Building generic cookie cutter homes so we can all feel the same is not the way to success.
Maestro Linden
Merged in a post:
Add support for MFA recovery codes
Alisyn Baxton
There have been ongoing issues with people's MFA getting messed up, either due to issues with SL, or with their own device configuration. We need to have the ability to respond to MFA using one-use recovery codes. This would allow users to 'self-support' and not require opening a ticket to restore access if they have issues with their MFA app. This is a common practice for most MFA implementations, so I'm not sure why SL did not include support for recovery codes when implementing MFA. I know from discussions in Discord that this is one of the reasons that more people do not use MFA for Second Life; the risk of being locked out due to malfunctioning phone or other key generation devices.
Alestes Resident
Good morning I have exactly the same problem. One of my premium plus accounts was recently hacked (and yet my password is hard) and that's due to the total absence of attack blocking by bruteforce. You should block the account with reactivation by email if you type the wrong password three times at the login. So Linden reimbursed me (zero excuses by the way and a week of reaction while I am premium plus I mean slowness) and I adopted the MFA. Result: the first false manipulation (the Google software is really bad and not translated) I zapped the token from this account and... Impossible to access my accounts without going through the MFA to deactivate the MFA... Seriously? It is amazing that after twenty years the ABA of security has not been mastered at Linden.
primerib1 Resident
I think something is wrong with the TOTP on LL side.
I'm using Authy so I can see how much time I have before the TOTP code refreshes.
I found that as long as I stay on the FIRST HALF of the refresh period, I can login using TOTP no problem.
But if the timer shows I have less than half period left, that is, I'm on the SECOND HALF of the refresh period, I won't be able to use the TOTP code. I have to wait until the code refreshes and only then can I use the (new) TOTP code to login.
LL, please check if the TOTP parameters are correct in your server-side TOTP configuration.
PS: The standard for TOTP specifies that, due to possible time drift between client and server, the server
should
accept 3 TOTP codes: The "current" TOTP code, the "previous" TOTP code, and the "next" TOTP code. It seems LL's implementation only accepts the "current" TOTP code + configured wrongly that it actually refreshes every 15 seconds rather than 30 seconds. If LL's implementation also accepts the "previous" TOTP code then I would have no problem logging in when I'm in the second half of the refresh period.Kira Balestra
primerib1 Resident I tried two authenticator apps (Google and Microsoft) and both of them only fail with SecondLife stuff, web and viewers. One of them also fails with discord, but neither of them fails with absolutely anything else.
I tried the SL website with different browsers (the result was the same)
In the end I had to remove the MFA and stick with just the password.
On other important websites where money is handled I usually have several extra security options, two-step verification, one-time codes by phone, or by email... any option that complements a simple password, no matter how long it is, they can still steal our accounts but at least it makes you feel a little less unprotected... There are MANY accounts being stolen lately and it is increasing, not only in SL, but in general, it is very necessary to have as many security options as possible, but that they work correctly for god's sake ><
primerib1 Resident
Kira Balestra Try to use the code within seconds of them changing on your 2FA app. If you have just opened the 2FA app, wait until the numbers change, then as soon as possible (within 10 seconds) type in the number and login.
TOTP is an Internet standard and the calculation should be identical between 2FA apps.
Also check that the time on your phone is accurate, at least to the 10s of second. Because TOTP works by hashing a secret key with the current time. So the numbers generated by TOTP with the exact same secret key at the exact same time will always be the same.
Kira Balestra
primerib1 Resident Thanks! I've been trying to use MFA again for a couple of weeks now and it's working fine with the Microsoft app. I don't know if that was a one-off problem or if it will happen again. I hope not! But I'm going to check out what you said anyway. Honestly, I don't have much idea about these things and it would be good to start getting to know it better.
Jerrod Diavolo
primerib1 Resident I can confirm that they only accept the current token, I use a Yubikey and retrieve the token with the ykman CLI on my PC so I can actually just copy&paste it and every single time it fails the login if I try that in the last few seconds of the 30s refresh period.
Load More
→