Text code numbers for added security

I regularly use ebay and PayPal on line and always have a long secure password. In addition to the password, always with ebay and about 30% of the time with PayPal, I get a text with a six digit code. An increase in security, definitely, but I would like to learn about any limitations to this.
What do you think?

You can set your device to being a trusted device. I've done that for my desktop PC for both Ebay and Paypal and now rarely get sent a code via text.

tinmar49 said:

I get a text with a six digit code. An increase in security, definitely, but I would like to learn about any limitations to this.

Click to expand...

One limitation is that is if you lose your phone you lose access to paypal etc. if you don't have additional verification steps enabled on paypal and other sites.
If bad guys stole your phone they could gain access to your paypal account therefore keep an eye on your phone all the time.

In any case a much more secure method is 2FA via authenticator app on your phone instead of SMS.
I suggest you Microsoft Authenticator app:

MS authenticator is better than that of google because of additional security features that the other does not have.

Twilio's Authy is good and works on Windows, iOS and Android.

It should be kept in mind that if the OP loses his phone, having Microsoft Authenticator or any other such app (I use the Google variant - personal choice), then he also loses computer access to any accounts so configured unless he has securely saved the 2FA recovery codes for each app using 2FA on other than his phone.

Not appropriately saving your recovery codes can come back to bite you. He/she, if they lost their phone, would want to change the passwords on the 2FA accounts ASAP via a computer or other smart device in case a thief could gain login access to the phone.

Regards,
Phil

@garioch7
MS authenticator can be set to be locked and requires phone password to unlock, so a thief would not be able to hack anything.
google authenticator is however wide open.

@zebal,

I did not know that, never having used Microsoft Authenticator, but the user would have to set up the auto-locking of that app. Would all users do that? I was just pointing out security vulnerabilities and pitfalls, particularly of not having secure access on multiple platforms to 2FA recovery codes.

Have a great day.

Regards,
Phil

Yes you're right, recovery codes are important but they are saved to disk, and if that disk is connected to computer then security is lost, so should be keopt on offline disk or CD and put into safe.

Or printed to paper to avoid any connection with your device.

kelper said:

Twilio's Authy is good and works on Windows, iOS and Android.

Click to expand...

I agree and if I am not mistaken, it's the only one that allows multi-device so should you lose one device, you can use another device to generate the codes. Places like Gemini seems to be tied to Authy directly.

PC Mag has a good review of authenticators but it hard to see which is which as the headings are missing!