HTML attributes to improve your users' two factor authentication experience

Post by gsich » Sun, Jan 12, 2020, 4:15 AM UTC

crazygringo wrote: post #48

OJFord wrote: post #46

Earlier quoted context omitted.

Of course there is, it can be on the same page (even hidden) up until the point it recognises a different mechanism is needed. Then browser autofill still works if the password is used. I also have the opposite problem - sometimes I want Firefox to remember my username but not password; the only way seems to be to have it remember a dummy password (1 char so I recognise it as such) and then decline to 'update passwor…

> up until the point it recognises But that's the point... how? It recognizes that when the user confirms they've finished entering their username by clicking some kind of button. At which point either a password box is shown or the alternative mechanism is shown. There's no way to know in advance. And it's a UX problem if a password box is shown by default, because then users who don't have passwords think there's a…

Post by Spivak » Sun, Jan 12, 2020, 5:13 AM UTC

philnash wrote: post #7

tobyhinloopen wrote: post #5

Didn’t we just learn you shouldn’t use SMS 2FA?

SMS 2FA is still stronger than no 2FA.

Post by techsupporter » Sun, Jan 12, 2020, 6:58 AM UTC

motohagiography wrote: post #33

Dealing with 2FA ux right now. There is a massive gap between threat intel people, product owners, and end users. From an identity assurance perspective, SMS is the best available. From an authentication perspective, it's increasingly dodgy. Reality is telcos have user enrollment almost on par with bank KYC, where everything else has great authN but with user asserted identity. Critics of SMS are technically correct,…

Post by latchkey » Sun, Jan 12, 2020, 7:21 AM UTC

techsupporter wrote: post #55

motohagiography wrote: post #33

Dealing with 2FA ux right now. There is a massive gap between threat intel people, product owners, and end users. From an identity assurance perspective, SMS is the best available. From an authentication perspective, it's increasingly dodgy. Reality is telcos have user enrollment almost on par with bank KYC, where everything else has great authN but with user asserted identity. Critics of SMS are technically correct,…

> Reality is telcos have user enrollment almost on par with bank KYC, where everything else has great authN but with user asserted identity. Are you sure? I don't mean that to sound hostile, genuinely asking. Because, at least in the States and Canada, I can get all of the +1 numbers I want on real SIMs for around a dollar apiece--or less if I work at it instead of just trotting down to Walgreens--and attach any name…

Post by philnash » Sun, Jan 12, 2020, 7:51 AM UTC

latchkey wrote: post #56

philnash wrote: post #29

Earlier quoted context omitted.

Absolutely correct, I've even given talks on this. Check out slide 52, I think we're in strong agreement here: https://speakerdeck.com/philnash/2fa-wtf-at-pycon-singapore?... . I'm not advocating for poorly implemented 2FA, just that SMS 2FA is more secure than just a password. If a site required you to have a 32 character length password, but kept the passwords in plain text, that wouldn't make your password any les…

SMS 2FA isn't more secure than just a password. It actually opens up holes. When my gf lived in Malaysia, she added her phone number to FB and forgot about it. Years later, after having moved back to Vietnam, the number was recycled and someone was able to use that number to gain access to her FB account and reset the password. Had she never added her number to FB (and you can extend this to any service which offers…