I believe Questrade's implementation of 2FA is insecure, due to choice during login.

People have been requesting 2FA for years, and they finally implemented it a couple years ago. Users have expressed that SMS-based 2FA is not very secure, and so authenticator-app based 2FA would be preferred. Even better would be hardware-based FIDO U2F keys.

At the moment we have email, SMS, phonecall, and authenticator app implemented. However, the problem I'm raising here is that the user is presented with the choice of using any of them while logging in. This means that if any 2FA mechanism is compromised (and email and SMS are much less secure), then the account can be accessed.

This means that Questrade's 2FA implementation demonstrates the principle of the weakest link: regardless of setting up the authenticator app feature, by providing the option to fall-back to email and SMS while logging in, the additional security provided by using an authenticator is made worthless.

A "normal" implementation of 2FA would have the user, once logged in, choose their 2FA mechanism (preferably the most secure option available), and then that would be the only option provided during login. If they lose access to that for whatever reason, it is preferable to have to contact support to reset access to their account, rather than allow the account to be compromised.

Anyone attempting to log in to an account should not be able to choose from multiple 2FA mechanisms, especially email which, if the attacker already has access to the user's password, we can assume would also be compromised. The user should choose in advance which system to use exclusively.

@ u/John-TeamQuestrade