Question about two-step verification

[stalkerski]

Two-step verification, when connected Security keys how to remove the authorization method through the Authentication Application since it is no longer necessary and even lose the level of protection

[Walter]

Hey @stalkerski, welcome to our Community and thanks for using Dropbox!

Can you please clarify what exactly you'd like to accomplish here?

Do you want to disable the Authentication App as a way to log into your account since you're using security keys now, am I getting this right? 

Let me know more and we'll take it from there. 

[stalkerski]

yes, you understood me correctly, because e. keys is considered the highest level of security, and it seems to me that its meaning is lost or a less secure way to unlock an account remains active. it's like coming up with a password for an account where you can go through authorization without a password.

[Walter]

So, in this case, you can change from using an authenticator app to receiving an SMS text to access your account or disable the feature in general. 

Can you give this a go through your account's Security page and let me know if it helps @stalkerski?

[stalkerski]

the way via sms is even older than through the application. no function free app and sms leave only U2F

[Walter]

Thanks for your feedback on this @stalkerski - it's been noted in our system.

Let me know if you have anything else to add. 

[Enc]

Security Keys like YubiKeys are not a gimmick. They are meant to increase security by replacing less secure methods of 2FA.

The current process at dropbox forces me to have an SMS key or Authenticator app to use 2FA. Even when I add security keys SMS/Authenticator can not be removed. Therefore I cannot replace the less secure method with Security keys. Subsequently, security is not improved or even reduced, by allowing more methods.

The suggestion is to allow only e.g. two security keys and disable all other 2FA methods. This ties the account to physical tokens and makes exploitation of access impossible.

[Nancy]

Thanks for your suggestion, @Enc. 

Just a clarification; do you receive the 2FA code via SMS/Authenticator app, even if you add a security key as a 2FA method?

Let me know, and we'll take it from there.

[Jay]

Hi @Enc, are you available to respond to my colleague's message earlier?

[Enc]

I can choose what I can use as 2FA method. But I would like to get rid of the less secure method of SMS and only have security keys available. 

I am not receiving an SMS if I didn't choose. But an attacker that is able to intercept the SMS can choose the SMS during his authentication.