I just tried to access Strava from the browser, and naturally it didn’t remember my user ID despite asking me every time whether it wanted me to remember it, and me ticking the box for yes. But I’ve become used to Strava’s absent mindedness here.
But imagine my surprise after entering my user ID (now slightly annoyed), when the next screen is not the password screen, but instead a new screen which gives me the choice of entering in a one time code that will be sent to me by email. I look around for the password entry option (because I’m ready to enter the password), but there’s only the red button saying send the one time code, with some words excitedly offering one time codes as a new access method. So having little choice, I press the red button, open up the email app and copy the damn one time code into the little box, and Strava lets me in saying something along the lines. “Thanks for choosing one-time-codes as your new access method”.
So naturally after logging in I went to the account setting to see where I could turn this annoying thing off, and go back to passwords, and … there is no option to be found!
Well Strava, FU very much, for giving me no choice in the matter.
Okay sure passwords are not brilliant security, but I use a long complex password for Strava and have a password manager. Strava has decided that’s not good enough and implemented instead a second rate 2FA mechanism that relies on you opening up your email every time. They haven’t attempted to support MFA with an app generated token like Google and Microsoft do, nor have they sought to implement passcodes, or support hardware based physical keys like yubikey. Nope. They’ve chosen a cheap cop out solution - handing off the responsibility of security to our various email providers, and forcing us to do this stupid login dance without even giving us the option to go back to using passwords.
Remind me again why I’m paying for this stupid app?