“2FA is a scam. 2FA is not made to benefit you.”
This is Rob Braxman, a self-proclaimed security expert who, as you just heard
him say very clearly, thinks that all 2FA is a scam. Now I have nothing personally against,
Rob - I’ve had nothing more than a quick email exchange with him - but the irony is
that within this same video titled “2FA is a big Tech scam” exclamation point, he also says this:
“But did you know that there is a way to do
safe 2FA without ever revealing any personal identity data...”
Ok, now we’re getting somewhere. There’s a catch, and I think it’s important for you to
understand this as you work to strengthen your online security. Today, I’m going to
react to Rob’s video, which many of you have been requesting. You’ll see that, in the end,
this whole video is one very interesting point covered up in a whole crap ton of click bait.
Welcome to All Things Secured, my name is Josh Summers and I want to state for the record that
I do not consider myself a security expert. Let’s let that sink in for a moment. Here I am,
on a YouTube channel dedicated to providing weekly security advice, telling you not to trust me.
Call me old school if you want, but I operate this channel under two fundamental ideas. First, don’t
take my word for it when it comes to anything I say about security and privacy. Hear me out,
do your own research and make your own decision. Because your threat model is different from mine.
Second, I believe that real experts are usually the ones who don’t have
to label themselves as such. Now, I’m not saying Rob doesn’t know his stuff,
and Rob has an open invitation to join me here on this channel, but I’m honestly more
skeptical when somebody self-identifies as an expert in some field, especially online.
And unfortunately, as in the case of this video about 2FA, this plays out in a very clear way.
Let’s start with Rob’s definition of two-factor authentication.
“Most of you have heard of two-factor authentication
or 2fa. This has been around a while and the first implementation of this
was when you had to be texted to confirm your login and password”
Now Rob and I both agree that 2FA text is not the most secure method of verification, but as you’ve
heard me say again and again, you also have the option to do authenticator apps and security keys.
In fact, most folks I respect in the security field recommend this for individual users.
“...there is a way to do a safe 2fa without ever revealing any personal identity data...”
So what does Rob think is a safe type of 2FA?
“...this verification technique is called totp which means time-based one-time password.”
Let’s be clear here: TOTP, that time based one-time code he mentions, is by any definition
a type of 2-factor authentication. I know Rob knows this, but what I’m not sure is
whether or not he’s intentionally trying to scare you by saying in no unclear terms...
“2FA is a scam.”
...when in reality, the magic solution he offers is...well, it’s 2FA.
Now what I believe Rob is really trying to communicate here, and something that I think
is important for us to consider, is that big tech companies are having to get very creative
in how they track us online and in real life.
The old method of cookies and GPS tracking are slowly being killed and their business model
relies on knowing who you are and what you want no matter which screen you’re looking at.
What does this have to do with 2FA? Well, the most private kind of 2-factor authentication
is the kind that is independent from the service you’re using.
So in other words, you might not want to use a Google app on your phone to verify your Google
mail account on your computer. There’s a fear that some companies might be using 2FA as a way to
link your devices together despite any desire you might have to keep them private and separate.
And he seems to have a point here. If you secure your Gmail account with a 2FA key like I do,
which I’ve talked about in a previous video and recommend, the only way to access that
Gmail account on my mobile device is to download Google’s Smart Lock app.
Whether you realize it or not, you’re basically registering your phone with
Google so that they can make that connection between your account and your device.
Perhaps that bothers you or perhaps you don’t care, but at least now you know it’s happening.
But what if you don’t use Gmail on your phone? Does Google force users to authenticate using a
mobile device? I don’t think so, but I’ll be honest, I’m not 100% sure.
At this point, we can use our phones to pay for things, to board airplanes,
to keep our insurance cards, and eventually to hold our driver’s license and maybe more.
And on this, Rob and I see a similar future.
“Yes, your phone will be able to supply authentication at all times to validate your
identity, but in each of those moments, big tech gets validation of each activity you just did”.
As always, your future decisions will be based on whether you value security and privacy or whether
you prefer convenience. Or maybe, in some cases, we won’t even have that choice. This
is definitely a bit concerning, but is 2FA the best example to explain this? I don’t think so.
What I do know is that Rob’s video on 2FA is purposefully sensational and let me save you
25 minutes of your life by giving you these general principles to help guide you along.
First, 2FA is not a scam. If you have the option to enable 2FA on one of your online accounts,
I recommend you use it. If you have a problem with Google, with Apple or any other big tech company
following you around, your problem isn’t 2FA, it’s your dependence on those particular
companies and their products. Rob, if you're watching this, why are you still using Gmail?
Second, where possible, using a security key like Yubikey is a stronger form of 2FA
than an authenticator app. I’ve already gone into detail about how you can set up your own
2FA key in this video that you can watch next if you like. These keys are not foolproof,
but they are currently the best consumer protection that I am aware of.
Third, I like to approach security with the idea of a separation of powers. For example,
if you use an Apple device, you could easily find yourself surfing the web with Safari, saving your
passwords with Keychain and getting directions through Apple Maps. For the sake of any level
of privacy, it’s better to separate these tasks among different companies and softwares, such as
Brave browser, 1Password and Maps.Me, so that no one company has too much control of your data.
And finally, with all respect to Rob, whom I don’t know at all, be skeptical of anybody
giving advice on the internet. Period. That includes me. Remember that being sensational
is a great way to attract clicks and views, and independent creators are keenly aware
that making a bold statement like 2FA is a scam while simultaneously offering 2FA as a solution,
unfortunately tends to result in viral videos. The only person being tricked is you.
If you found this video helpful, please give it a thumbs up and then take a look at this next video
where I address the common question: why should I care about privacy if I have nothing to hide?