twofactorauth VS twofactorauth

jdavis/twofactorauth - List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software.

FYI: Sites that provide 2FA may or may not be listed in https://github.com/2factorauth/twofactorauth

Using the 2fa.directory as a start, I recently went searching for banks that specifically support MFA via hardware or software tokens. Almost all are non-US based which shows how far behind the US financial industry is w/r MFA. I found one, First Tech Federal Credit Union, which supports software tokens using the Entrust IdentityGuard app. They support business and personal accounts and you can apply online.

Further information that the domain was sold by one of the contributors due to a dispute - https://github.com/2factorauth/twofactorauth/issues/5238

See: The twofactorauth[.]org site has been taken over #5238

That said, where possible, 2FA should not rely on a phone number. SMS and Voice are unauthenticated and unencrypted. It's easy and cheap enough to setup a stingray to grab all text messages in an area, and SIM swap attacks are also typically pretty easy (difficulty varies by provider from incredibly simple to might require calling back a few times to get the right rep). Switch to an authenticator app for anything that supports it (https://twofactorauth.org/).

I backup my seed data every account that has 2FA/MFA support (see https://twofactorauth.org/) into Keepass. It's fairly simple to do. I use a program like Windows' Snipping Tool to capture the QR code displayed by the new 2FA-based service and I save the file as an attachment into my Keepass on the password entry for the 2FA-based service. I also use a QR code reader that deciphers the QR code and then I save that URI string into Keepass as well, extracting the TOTP seed data and also using the KeePassOTP or other KeePass plug-in to allow me to generate TOTP codes directly from my Keepass vault files on either my PC or Android devices.

Also https://twofactorauth.org/ to check which of your sites have it as an option.

It's absolutely unacceptable. A visit to https://twofactorauth.org/ will quickly either dash or build your hopes for the future of online security, depending entirely on what country you live in.