I feel that most forms of 2FA have too much friction for average users. SMS is bad, but better than nothing. I really can't imagine average users figuring out TOTP apps, U2F or other hardware tokens and dealing with backups and lost keys etc. Perhaps fingerprint based solutions based on WebAuthn will get more mainstream.
The bleak picture of two-factor authentication adoption in the wild
71–80 of 96 posts
Re: The bleak picture of two-factor authentication adoption in the wild
#72Earlier quoted context omitted.
Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices. Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.
TOTP is old and busted, U2F is the new hotness. https://en.m.wikipedia.org/wiki/Universal_2nd_Factor
> The device key is secured against duplication by a degree of social trust in the commercial manufacturer
TOTP sounds much better. Also doesn't requires "trusted magic hardware"
Re: The bleak picture of two-factor authentication adoption in the wild
#73Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
Use TOTP with andOTP or make your own generator, it's easy.
Re: The bleak picture of two-factor authentication adoption in the wild
#74Earlier quoted context omitted.
One requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.
It's disturbing how many developers simply gloss over the fact that requiring a smartphone with one of two non-free OSes installed (Android and IOS) is severely limiting the user's freedom in their use of digital services. In the Netherlands the ING bank was testing the waters this year by holding back on announcing a non-smartphone alternative to their ageing authentication methods (either SMS or a list of pre-gener…
could you give some exapmples on how it limits the use of your device?
while i agree with you, i seem to lack the imagination to come up with realistic examples that i can present as arguments.
i am afraid anything i think of would get a response like "yeah, sure, but noone uses their phone like that" or they'll simply accuse me of being paranoid.
Re: The bleak picture of two-factor authentication adoption in the wild
#75Earlier quoted context omitted.
The right way to do it is to use client-side TLS certificates in combination with the username and password. Add in a passphrase for the private key and you could have 3FA. All that's really needed is for browser vendors to improve their UI for generating certificate signing requests and importing certificates.
Meanwhile usability cries in a corner.
Estonian ID cards or Estonian Mobile ID is not hard to use. The currently working system is proof that TLS client certs can be easily used if provider just supported it.
Re: The bleak picture of two-factor authentication adoption in the wild
#76Earlier quoted context omitted.
One requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.
So I need a physical token for each of my bank accounts (3 bank accounts), each of my investment accounts (2 investment accounts), each of my e-mail providers (2 e-mail providers) and one for every other service which might want to offer 2FA. Or, instead of that, I can have one smartphone, which has an app which handles all of those 2FA codes for me. Can you understand why I would prefer the smartphone option?
loose your phone and all your accounts are locked until you can resolve it.
that may be fine for some things, but surely not my bank account
Re: The bleak picture of two-factor authentication adoption in the wild
#77Earlier quoted context omitted.
Yes, but one has to buy another device, and only a limited number of companies support it at the moment [1]. It doesn't look like any of the banks I use, any of the credit cards I use, or the tax filing service I use support it. Not to mention that this website and other forums I log into aren't mentioned there either. Some of those companies offer SMS or email based 2FA as an option. In any case, every single one of…
There are others which aren't listed there, like OVH (the largest European hosting company). The dearth of banks is real though. And sad. I have only seen client-side certificates used twice. Once at now infamous StartSSL and second at a bank but for vendor access, not regular customers. Its huge downside is that it's a second factor which doesn't protect against a compromised device.
Client-side certificates are widely used among the Estonian population btw. It's basically the rest of the world that has caused the need for U2F/TOTP because they can't deploy smartcards with certs to users.
Re: The bleak picture of two-factor authentication adoption in the wild
#78The failure mode of TOTP, SMS is that the user needs to be sure to be connected to the correct site. The hidden assumption is that the use is able to distinguish the fake from the correct site. For any authentication system to work in the face of adversaries trying to confuse a user, the system needs to be robust against that. https://eccentric-authentication.nl/blog/2014/11/30/spot-the... https://eccentric-authentic…
true, 2FA prevents against people pretending to be you trying to log into the site, but not against sites pretending to be the site you want to access.
Re: The bleak picture of two-factor authentication adoption in the wild
#79For those among us who can handle our passwords and general security, 2FA is just a penalty we have to pay for those who can't. As far as possible, I ditch any company that wants to force it upon me. I've done my homework, I don't want to consult my telephone, my mailbox, or even worse, some pesky dongle to complicate my life and add to my expenses.
as mentioned elsewhere, 2FA protects against identity theft in that someone can call your bank, pretend to be you and get access, whereas it is actually less effective against phishing sites that will ask you for your 2FA code and if you didn't notice you are on the wrong site you'll likely just give it to them.
while you can protect yourself against fishing, and there 2FA is indeed less useful, you can't control how diligent the bank is in verifying your identity.
Re: The bleak picture of two-factor authentication adoption in the wild
#80It completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for second factor authentication (to protect my video game account). Where as I feel I'm still waiting for my bank (actual money) to catch up. they took the easy way out by sms-ing me a second factor authentication key. Even though phone number theft is a known a…
My bank used to do the tokens until some mathematician reverse engineered the algorithm proving it insecure.
They've now moved on to certificates on your phone.
You go to the bank, prove your identity, they sms you a certificate. When you choose electronic authentication on the website you get a popup on your phone to accept. You put in a password and it validates the cert on your phone and sends the response to the website.
All without having to install anything.