I’d give a lot to be able to forcibly delete Authy-specific 2FA accounts from the app. Today I’m stuck with old dead account tokens.
HTML attributes to improve your users' two factor authentication experience
41–50 of 82 posts
Re: HTML attributes to improve your users' two factor authentication experience
#42Earlier quoted context omitted.
In an idealized sense, sure. But not for a practical situation. SMS as an authentication factor weakens the security because of all of the additional behaviors associated with the account provider which are inescapable.
Edit: looking again, I see what I missed. > The only real defense is to never associate your phone number with personal accounts which even then is often not possible. Yes that's exactly right. If I don't trust a website to not use my phone number as the sole factor for recovery, then I should not use SMS 2FA on that site and I should not add my phone number to any part of my profile. If I know (how?) that the websit…
It's one of those things which, technically, can be done correctly. However, it isn't. It provides an incentive to do bad security which is bad for providers because their security will have a tendency to devolve into bad-factor recovery and it's bad for users because it makes them comfortable with a security factor which is easily defeated.
It might be good for your use case, but systematically SMS is bad for security in a global society sense.
Re: HTML attributes to improve your users' two factor authentication experience
#43Earlier quoted context omitted.
The back door is either automatic or human account recovery tools. These tools generally put way too much trust into the phone number and allow someone who has compromised that number to take control of anything it has ever touched. Phone numbers are very public and easy to steal in ways which are difficult to defend against. Imagine someone in a domestic abuse situation having their phone taken, with sms 2fa, how ha…
> Imagine someone in a domestic abuse situation Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think all 2FA can be bypassed with that, if not most of modern cryptography. https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis > having their phone taken Keep in mind that other 2FA methods also are phone based, like TOTP / Google Authen…
It is, in many ways, a worse vulnerability than rubber-hose cryptanalysis. When you run away from the person with the hose, you can change your passwords and they won't be compromised any more.
If somebody has your phone, a physical address associated with you, and some basic biographical information, they can continue recovering access to your accounts in a way which is difficult to escape, especially because of the misplaced trust in using phone numbers for security.
The threat in that situation is being vulnerable and having to digitally escape as well as physically escape, and if you don't do both simultaneously you can be continuously compromised in a way which is very difficult to succeed.
Re: HTML attributes to improve your users' two factor authentication experience
#44While Twilio does a lot right, they still only offer SMS and their own proprietary Authy solution for 2FA for their website. No TOTP (and still no plan to offer the industry standard) means that this has a whiff of hypocrisy.
Twilio seems to have some great engineers and I'm often impressed by the quality of their technical writing, but you'd never know it from their console horrowshow UX.
See also: AWS.
Re: HTML attributes to improve your users' two factor authentication experience
#45These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/
That happens whenever certain usernames trigger different authentication pathways.
There's just nothing you can do about it if some users have passwords but other users have different authentication mechanisms.
Re: HTML attributes to improve your users' two factor authentication experience
#46These are all super nice and I really wish more developers made use of these, but my main complain is not having username and password fields on the same page :/
That happens whenever certain usernames trigger different authentication pathways. There's just nothing you can do about it if some users have passwords but other users have different authentication mechanisms.
Of course there is, it can be on the same page (even hidden) up until the point it recognises a different mechanism is needed. Then browser autofill still works if the password is used.
I also have the opposite problem - sometimes I want Firefox to remember my username but not password; the only way seems to be to have it remember a dummy password (1 char so I recognise it as such) and then decline to 'update password' every time I change it in order to login.
Re: HTML attributes to improve your users' two factor authentication experience
#47Is type supposed to be "text" instead of "number" in the inputmode snippet? Wouldn't it still strip leading zeros the way it is now (with type set to "number")?
Re: HTML attributes to improve your users' two factor authentication experience
#48Earlier quoted context omitted.
That happens whenever certain usernames trigger different authentication pathways. There's just nothing you can do about it if some users have passwords but other users have different authentication mechanisms.
Of course there is, it can be on the same page (even hidden) up until the point it recognises a different mechanism is needed. Then browser autofill still works if the password is used. I also have the opposite problem - sometimes I want Firefox to remember my username but not password; the only way seems to be to have it remember a dummy password (1 char so I recognise it as such) and then decline to 'update passwor…
> up until the point it recognises
But that's the point... how?
It recognizes that when the user confirms they've finished entering their username by clicking some kind of button.
At which point either a password box is shown or the alternative mechanism is shown.
There's no way to know in advance. And it's a UX problem if a password box is shown by default, because then users who don't have passwords think there's a bug in accessing the resource (because they don't have a password).
If your password manager has a problem with filling in the username, then the problem is with your password manager, not with the login flow. Starting with username-only is an industry standard for any product used in enterprises.
Re: HTML attributes to improve your users' two factor authentication experience
#49I want a one-step-login. Not two step (first username, then password) and certainly not three step (username, password, 2fa, all in seperate pages). This braindead concept needs to die.
If no 2fa is active on the account, just accept anything (including empty strings) in that field.
Re: HTML attributes to improve your users' two factor authentication experience
#50Is type supposed to be "text" instead of "number" in the inputmode snippet? Wouldn't it still strip leading zeros the way it is now (with type set to "number")?
The one after it has "text" so I'm guessing it's just a mistake.