SMS verify, Authenticator Apps, Passkey. Which do you prefer?

[Hyphen(-)]

If possible, activate multiple 2FA to safeguard your account. Scammers usually target the weakest link between you and your coin and 2FA is that link. You should choose wisely.

Almost all the 2FA method you mentioned have their weakness which generally means that none of them is completely safe; then why use centralized exchanges to save our long term holding Bitcoin?

You can chose the strongest one for your exchanges you are using for trading and maybe quick transactions, but when it comes to where you save your money like you lifetime Bitcoin savings, using non-custodial wallets will be better so that you will just have to battle with how to save your seed phrase instead if relying on any security factor to help you safeguard your exchange and your money. Do it yourself because not your keys, not your Bitcoin.

[ImGenius]

snip-.

I prefer Passkey or hardware security key , it gives more security that other options. Second priority if first one isn't available is authenticator. Authenticator is way for safer than sms 2fa.

[Sim_card]

You are talking about an exchange service which is wrong for you to store your bitcoin in an exchange for long because you are not in full control of the private keys. Like other members said above before my post, a self custody wallet is the best to store your bitcoin since you're in control of your private keys. For better security add passphrase to your seed phrase.

[Audrey Simmons]

If possible, activate multiple 2FA to safeguard your account. Scammers usually target the weakest link between you and your coin and 2FA is that link. You should choose wisely.

This is not a problem, you can actually have all setup for your app.

For someone with access to your device can force himself through SMS and Authenticator apps, what they will never know is your passkey, don't make it simple, easily guessed or something related to you. Always enable passkey for every transaction, sometimes it can be toggled off, but don't neglect to activate it always.

[Peanutswar]

Base on my experience ive seen the cons of SMS and 2FA recently, most of the devices we are using right now recommend to us to use this feature, but imagine if you lost your device and we knew that this two thing can easily access even without your permission once the device stole already unless you locked once you notice as possible. Also there are some cases such as SIM swapping and once they verified your number to an email connected to your device with 2FA they can now access the codes. Now for me having a passkey is much safer but of course not ideal to store this online or to your device.

[Catenaccio]

Base on my experience ive seen the cons of SMS and 2FA recently, most of the devices we are using right now recommend to us to use this feature, but imagine if you lost your device and we knew that this two thing can easily access even without your permission once the device stole already unless you locked once you notice as possible. Also there are some cases such as SIM swapping and once they verified your number to an email connected to your device with 2FA they can now access the codes. Now for me having a passkey is much safer but of course not ideal to store this online or to your device.

Exchanges or casinos only provide 2FA in user account settings, in security setting option for users but it's responsible of users to activate 2FA or ignore it. It's unlike mandatory KYC requirement if exists, users have to complete the required KYC level before are able to fund their accounts, and use the exchange with full features.

2FA is like an extra security option for choosing, it's freedom to choose or don't choose it, as an account security and safety is an individual concern, if you want better security, activate 2FA.  Between SMS and 2FA application, application is better for security and user experience as SMS might not be delivered well.
https://www.privacyguides.org/en/multi-factor-authentication/

[maydna]

You can activates 2FA SMS, emails, and other 2FA type to secure your account and wallets. A passkey and saving your coins in separate devices are needed so you will not open the device too often. That can reduces the hacker's chances identify your wallet.

But behind 2FA, most important is not to tell others that you have Bitcoin or anything related, which preventing bad guys from stealing from you.

[DYING_S0UL]

I personally don't like sms 2FA, as it can delay the code sometimes (depending on the place/network/weather condition)...and many times I have had bad experience with it, after a couple of missed/tries/delayed codes, it won't work at all, and tell you to "try again later" or lock you out for some times. This really sucked...

Authenticator apps are good imo, if you know how to keep them safe/separate, and use the relaible ones, like Aegis, which is open source. For example, I have a 2nd phone for these types of things. I rarely use that phone, and only use it for codes, and other security or transactions. I have never used it for normal use or general purpose.

As for passkey, I don't use it. And don't have any plan for it.

[Chibit01]

Do you know that 2FA most of the times uses your email address or at most some digital codes which you should keep save. All this are third party applications which are never safe. The best option still remains using custodial wallet and it should be cold wallet. Thereby you keep your phrases (seed phrase or pass phrase) safe. There is no better security than that.

Aside from Google authenticator which allows you to back up the keys down to your mail, do other 2FA apps makes it compulsory for you to back it up to your mail? I'm asking because with Google authenticator app it's optional for me to synchronize all my linked service to it, and even as that I just considered the 2FA to be an extra layer security which you apply after other security measures have been put in place, and not like I'm trusting a third party entirely to do the job.

[SquirrelJulietGarden]

Aside from Google authenticator which allows you to back up the keys down to your mail, do other 2FA apps makes it compulsory for you to back it up to your mail? I'm asking because with Google authenticator app it's optional for me to synchronize all my linked service to it, and even as that I just considered the 2FA to be an extra layer security which you apply after other security measures have been put in place, and not like I'm trusting a third party entirely to do the job.

Storing backups in emails, it's dangerous and not only with your 2FA code backup, it's for backup of anything else. Backups need to be stored offline and not on any third party like Gmail or any email provider companies or cloud storage.

Google authenticator has something not good to use such as it is close source, and some controversial but actually bad features like backup to emails. There are other better 2FA applications to use like Aegis.

https://getaegis.app/

[Comeacross]

I personally don't like sms 2FA, as it can delay the code sometimes (depending on the place/network/weather condition)...and many times I have had bad experience with it, after a couple of missed/tries/delayed codes, it won't work at all, and tell you to "try again later" or lock you out for some times. This really sucked...

Authenticator apps are good imo, if you know how to keep them safe/separate, and use the relaible ones, like Aegis, which is open source. For example, I have a 2nd phone for these types of things. I rarely use that phone, and only use it for codes, and other security or transactions. I have never used it for normal use or general purpose.

As for passkey, I don't use it. And don't have any plan for it.

SMS 2FA is the worst among the three options. I have had codes arrived 5 minutes late when I'm already locked out. And several attempts to request new code get you suspended.

Passkey is still early. Some platforms are promoting it by recommending it to their users. In the next few years to come, you'll probably have a change of mind. I have used the three but Passkey seem to beat the rest unless if there is a case of device lost.

[Cookdata]

I don't prefer SMS verification
Or Authenticator apps or even passkey

sms verifications are very dangerous. Aside from the fact that your sim can be compromised anytime, I don't like OTP through sms, if you got caught during server congestion, the message will get delay from the network provider before it get to you.

If you live in a country where network provider change SIM ownership of you stop using a sim card, sms is the las option for any verification.

Because I don't need them to keep my Bitcoin safe.
All I need to do is keep my recovery seed offline, this is the only security protocol I need.

Remember, passkey has a problem, the moment you lost your device you aren't getting the passkey back.
The biggest mistake you can make is keeping your coins via a platform where you need your phone or sim card to access your coins.

This isn't accurate. I lost access to my android phone and I was trying to reacess emails I used and they were linked to passkey so that when I try to login another device, I don't have to go through security questions. I did my recovery and got my email back and I had access back to my email and enable another passkey on that phone, this work because passkey is saved in in Google. This could be the same for Icloud but I haven't tried it before because I don't lose sight of my iPhone.

[Asiska02]

If possible, activate multiple 2FA to safeguard your account. Scammers usually target the weakest link between you and your coin and 2FA is that link. You should choose wisely.

I have never used pass keys before as a 2FA to use to provide security to my account. SMS 2FA is not even a reliable one for me, so I don’t even depend on them and have stopped using them since the coming of Authenticator apps. Google Authenticator has its cons when it comes to recovering after you lost your device. If you’re the type that didn’t enable sync, have safe backup of secret keys and backup codes saved, you’ll lose access to many of your accounts. For users that value their privacy and wants a total control of their security backups and wants an open source software, Aegis Authenticator is a better option compared to Google Authenticator which is closed source.

Aside from Google authenticator which allows you to back up the keys down to your mail, do other 2FA apps makes it compulsory for you to back it up to your mail? I'm asking because with Google authenticator app it's optional for me to synchronize all my linked service to it, and even as that I just considered the 2FA to be an extra layer security which you apply after other security measures have been put in place, and not like I'm trusting a third party entirely to do the job.

No, this is not compulsory. Most of the 2FA applications do not force you to do backups on to your email account. They have their own distinct ways of handling backups, so you just have to check if it’s important for you to do it or let it be. It is optional and the choice is yours to pick from.

[joniboini]

If you live in a country where network provider change SIM ownership of you stop using a sim card, sms is the las option for any verification.

I also don't view SMS verification favorably, but I'm not sure what this means. Are you saying in other countries people can own ownership of a phone number permanently even if they never top up or connect it to the network at all? In my country it's common for people to lose their number after they no longer use it for a few months, and the provider will just sell it again with another card.

As far as auhenticator goes, using open source app which offers convenient backup method is probably the best one for me.

[Mpamaegbu]

I use GA 2FA on most apps and sites I'm subscribed to but at the same time I make sure they're linked to an email address. Relying only on SMS as a 2FA isn't a good idea as phones can be stolen and SIM cloned easily.

I also use finger biometrics but that will only be on sites I know I need another site to finalize what I'm doing. The other site won't be on the same device I'm using for the first. For instance, I use Device A for my wallet. Then I use Device B for my exchange account. I only do the biometrics thing with wallet apps. Occasionally, I also switch that from biometrics to passwords or pins.

We've to do all we can to beat scammers and hackers at their game.

[Somegory]

Scammers don't hack your Bitcoin, they hack where you keep your coin. This means the security of your account is now determined by the types of 2FA you use.

SMS 2FA is linked with your mobile phone number. You receive message with a code to log in to your account if you have it enabled but this method is defeated with sim swap attack. If attackers succeed in swapping your sim, they will be the one receiving the code and your account might be at risk.

Authenticator Apps are time based codes generated on your device. It has no business with your sim. It's much better than SMS 2FA but it's free from risk. Phishing sites, malwares and cloud sync makes it vulnerable too.

Passkey is linked to your device. If you have it enabled, you can only perform action on your account only if you have access to the device you registered it. It does not work with code or sim but with the security key on your device. Passkey is phishing proof by design.

If possible, activate multiple 2FA to safeguard your account. Scammers usually target the weakest link between you and your coin and 2FA is that link. You should choose wisely.

Your Bitcoin shouldn't be kept in any account or platform, SIM cards and mobile numbers shouldn't have anything to do with your Bitcoin wallets.

You are already on your path to losing your Bitcoin is your number and SIM card is involved, anything different from private keys and recovery seeds doesn't count.

Let's keep telling people to take full responsibility of their recovery seeds rather than trying to use 2FA because they don't matter like how important recovery seeds are.

[Cricktor]

If you intend to use passkeys, I highly recommend to setup them with an additional backup device which you don't carry around and which therefore likely won't be lost or stolen or whatever. I know, this is additional gear required, but in the end it pays off.

There are also password managers which can store, sync and handle passkeys neatly, e.g. 1Password (not particularly advocating for them).

[DYING_S0UL]

....snip....

SMS 2FA is the worst among the three options. I have had codes arrived 5 minutes late when I'm already locked out. And several attempts to request new code get you suspended.

Passkey is still early. Some platforms are promoting it by recommending it to their users. In the next few years to come, you'll probably have a change of mind. I have used the three but Passkey seem to beat the rest unless if there is a case of device lost.

Yeah I suffered a lot because of it. The old ones (codes) wouldn't work as I had requested for a new one. And the new one wouldn't arrive at the right time. And when it does, it basically is expired.

Like I already said, I don't wanna use passkey, it's kinda hassle for me. What if I lose my device (although I don't have any idea what happens then or how do am I supposed to recover/reset the passkey.