Please, if you back with Ally bank, email them and tell them you want Webauthn, not SMS. Ask to have the email forwarded to the head of development.
Please and thank you.
Ask HN: Why is WebAuthn so slow to take off?
21–30 of 182 posts
Re: Ask HN: Why is WebAuthn so slow to take off?
#22My guess as someone who's been in a position to implement it a few times but haven't gotten to:
- "Upstream" Support, For various combinations of stacks I've worked on, there has always been one component that didn't support it cleanly, (Flutter x Ory was my last attempt for example). If it was as easy as "just" enabling it I'm sure it'd be more popular, but when your provider or tech stack doesn't support it out of the box it's usually not worth the effort to implement it from scratch.
- Customer support. This has many sub problems. At my current job, customers get confused between social login and email/password all the time. Adding a newer more complicated technology would be a recipe for disaster.
Similarly, because my job deals with money in a country where mobile theft is fairly rampant, the additional burden of trying to reassociate a users public key/account/device is problematic.
Finally, I think the concept of managing private keys for a user is fairly complicated, though with passkeys and google/apple syncing your private keys for you I hope to see this burden fall away, and with it the rise of webauthn
Re: Ask HN: Why is WebAuthn so slow to take off?
#23I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
From a practical standpoint, i dont really think it matters. The real threat 2fa auth solves is the fact people blame the site operator when they are hacked. 90% of the time it is due to reusing a password. The other 10% it is due to phishing. WebAuthn stops both. 2FA works not because it adds another factor, but because it removes choice from the user so they can't screw it up.
Interesting take on 2FA. The user not being able to screw up is of course important, but the second factor (something you have) works primarily because it is tied to something physical and therefore local to the user, which is not subject to remote attacks.
Re: Ask HN: Why is WebAuthn so slow to take off?
#24We use it at work and for whatever reason every time I get it working one one device, it stops working on another. That and it seems to be fragile across the VPN.
Re: Ask HN: Why is WebAuthn so slow to take off?
#25I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
Re: Ask HN: Why is WebAuthn so slow to take off?
#26Re: Ask HN: Why is WebAuthn so slow to take off?
#27I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
Devices get snatched out of hands all the time.
Re: Ask HN: Why is WebAuthn so slow to take off?
#28I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
[deleted]
Re: Ask HN: Why is WebAuthn so slow to take off?
#29Earlier quoted context omitted.
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
Devices get snatched out of hands all the time.
Even if they snatch it unlocked they still can’t login because there’s an extra biometrics check required for WebAuthn
Re: Ask HN: Why is WebAuthn so slow to take off?
#30I'm not a huge fan of removing the 'two' from 'two factor authentication'. If people can login with just their device, which could be stolen, I don't think it's as secure as a password+device based 2FA alternative
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
That makes sense (as long as device asks for PIN every time you use webauthn). Bank card uses the same logic: you present both card and PIN code and it counts as two factors.