Solved MS asking for cell phone number

I just read up on the situation in Australia (I live on the opposite side of the globe) A few posts up, I said that 2FA without recovery option is not a good idea, making it in effect 3FA, and the question comes up (has always been) how much info do you disclose? Where is the line?

Not much more than that for me, avoid on-line transactions if possible, and do biz locally, the pandemic made it difficult, but things are easing up.

Haydon said:

I think that it is important to note that 2FA practically necessitates not just 1 but 2 phone numbers, default and recovery. At least that's what I always do to minimize chances of a lock out. If recovery is not given as an option (either 2nd phone or some other reliable recovery option) then don't open the on-line account in the first place, look for alternatives.

Generally speaking, the more secure, the more hassle it causes to recover from a failure, and reliable recovery becomes essential. Edit: I hope this statement is not misinterpreted as me being against more security, LOL

Click to expand...

I have to disagree. In fact, I categorically disagree with that statement, only in a few places is SMS the only way to enable 2FA / TFA / MFA. Otherwise you have plenty of other options.

Here is an excellent guide explaining in detail that 2FA is and how it works and why the older 2SV (2 step verification) has been superseded by more modern approaches, including hardware tokens and software tokens, for authentication purposes.


In addition, for a list that does its best to stay current with sites and software that support 2FA (and the various methods supported per site / software) see https://2fa.directory/

johnlgalt said:

I have to disagree. In fact, I categorically disagree with that statement, only in a few places is SMS the only way to enable 2FA / TFA / MFA. Otherwise you have plenty of other options.

Here is an excellent guide explaining in detail that 2FA is and how it works and why the older 2SV (2 step verification) has been superseded by more modern approaches, including hardware tokens and software tokens, for authentication purposes.

Two Factor Auth | BrainStation®

Learn about two-factor authentication (2FA), an extra layer of security that includes SMS, email, phone calls, hardware, and software.

brainstation.io

In addition, for a list that does its best to stay current with sites and software that support 2FA (and the various methods supported per site / software) see https://2fa.directory/

Click to expand...

Well, the topic of this thread is cell phone number and hence SMS (or voice, or app or whatever) and I am sure that outside of forum participants and the like, pretty well all who use 2FA use SMS. Office workers may want use their work cell phone if they don't want to disclose their private cell phone. Come to think of it, as an office worker you may not even be allowed to use the 'more modern approaches' if corporate IT does not understand what it is.

Edit: I responded to what you bolded, but perhaps there is some other issue? Anyway, regardless of the nature of the 2 media, if the second of 2FA fails, you need a recovery option which makes it in effect 3FA, again regardless of the nature of the third medium. And the issue of disclosing more and more still pops up.

Good post john

johnlgalt said:

I have to disagree. In fact, I categorically disagree with that statement, only in a few places is SMS the only way to enable 2FA / TFA / MFA. Otherwise you have plenty of other options.

Here is an excellent guide explaining in detail that 2FA is and how it works and why the older 2SV (2 step verification) has been superseded by more modern approaches, including hardware tokens and software tokens, for authentication purposes.

Two Factor Auth | BrainStation®

Learn about two-factor authentication (2FA), an extra layer of security that includes SMS, email, phone calls, hardware, and software.

brainstation.io

In addition, for a list that does its best to stay current with sites and software that support 2FA (and the various methods supported per site / software) see https://2fa.directory/

Click to expand...

Also, as stated before, and per Microsoft - you don't need to provide a phone number for 2FA if you're using the Authenticator app...

Dru2 said:

What you'll need for set up

"Two-step verification begins with an email address (we recommend two different email addresses, the one you normally use, and one as a backup just in case), a phone number, or an authenticator app. When you sign in on a new device or from a new location, we'll send you a security code to enter on the sign-in page. For more info about the authenticator app, see How to use the Microsoft Authenticator app."

Source: How to use two-step verification with your Microsoft account

Note the requirement says either the Authenticator app OR a phone number (for those fearful of proving a phone number). Those using the phone instead of the app would get their authentication codes texted to them. That's the reason for the phone number

Click to expand...

I think people want to believe what they want to believe just to be in opposition no matter the facts

Gee, are we in kindergarten here?

Haydon said:

Gee, are we in kindergarten here?

Click to expand...

At times.. yes

If that's the only level you understand then yes