2-Factor authentication on webmail

[#1]

2FA is predicated on alternate methods of authentication. If there are not then it becomes less than 2FA (IMO). Some '2FA' relies on the presumption of a smart phone (a required app to provide the 2FA). Which is a bit more secure that using e-mail, but relies on the presumption of a smart phone (a non-available method)

"The site I ordered toner from this week sends 2FA to email." Personally, I wouldn't call that 2FA. More 1.1FA?

My account on A&A (VoIP) is monitored and they'll send an alert (to the e-mail address they have registered) if they detect a sign-in to the account I hold. That isn't 2FA. That is an alert of a possible breach.

[#2]

---

@Townman wrote:
Again presumption that everyone has a mobile phone and everyone has a decent t signal.

---

That's not a strict requirement for 2FA to work.

I started using 2FA over 30yrs ago long before smart phones even existed. We used an RSA authenticator device to enable remote access from a desktop PC to support clients from home. WFH has been around for a while 🙂

While smart phones can be used as authenticator keys they are not necessary - think of the smart tokens banks have used recently. An internet connection is not needed for a hardware based authenticator to work.

Most software authenticators also work offline, some only require a periodic connection to synchronize their clocks.

Password only security, however complex the password, is risky these days, it only needs to be breached once!. It is the security of the third party's where you have used your email details that's the potential risk.

Personally i would recommend the use of 2FA where possible and most mainstream email providers now support it.It's no longer a niche product.

Even BT mail supports it!

https://www.consumersearch.com/technology/maximizing-security-bt-email-login-best-practices-tips

[#3]

I too recall authentication devices - only worked for the single service. Just goes to show there’s little which is really new.

[#4]

Challenge/response keypads with pre-shared keys? (still used by banking now)

[#5]

2FA - Not much use for those of us who cannot find their mobiles....

Challenge/response keypads - Not much use for those of us who cannot find the supplied keypad....

[#6]

@Champnet 

2FA - not much use without one of the factors 😅