The New Ten-Factor Authentication Processes

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain.

Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix?

Digital OTP, like the kind provided by 1Password or Bitwarden, are a little more convenient. And having Google Voice means I can easily copy codes sent via text straight from my laptop.

But it's something I'd rather not even have to pay attention to. I don't need to manually enter a code to get HTTPS.

> our non-technical brethren

Nah. I currently work for NYU and find their 2FA system pointlessly burdensome. I need to type my password (in practice, unlock my password manager) and then procure my second factor every day, on every device I use. Inevitably any mobile app I need to interact with requires doing all of this again, except this time inside a custom webview that doesn't remember cookies. I have never worked for a tech company that made things this annoying, and I can't fathom how bad it must be for anyone who needs to use e.g. a screen reader.

Sigh. We're working to normalize better UX around account security at https://clerk.dev

It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.)

If you're working to improve your sign-in flow, our biggest wins so far have been:

- OAuth buttons at the top, critically with Google included. OAuth is _way_ faster than passwords for most users, putting it at the top switched oauth usage from just below 50% to just over 50%. Those extra percent using oauth bring down the overall average speed.

- Eliminate OAuth "edge cases." Turns out, they're not edge cases at all. 15% of users will sign up with email/password then try OAuth next, or will sign up with OAuth then try email/password next. Make sure you have happy paths for these.

- Magic links instead of OTPs for passwordless auth. Overall, magic links are a few seconds faster than OTPs since there's no entry step. (That said, we're still investigating whether it's better to trigger OTPs on mobile devices because of the auto-fill capabilities)

- Integrate with password managers. Our sign-in flow is normally two screens, but if we detect a password manager we'll accept the password on the first screen. Password manager folks are already the fastest, but this makes them even faster.

This is just the first factor. Admittedly, our second factor is still lagging behind, but UX is getting better for 2FA with FaceID & TouchID. We're optimistic we can have a positive impact on the second factor, as well.

If you're interested in having a team obsess over this on your behalf, come check us out :)

How much Time does 10 factor authentication take ?

The two factor where I work, Google, uses security keys for the second factor. I think offering these as an alternative to the email/SMS codes would be nice, tapping a little USB nub isn’t nearly as annoying as grabbing a code from another webpage or device.