61–70 of 82 posts
Earlier quoted context omitted.
Nope, not if it introduces common customer support backdoors.
If it is enough with access to the phone number, no password needed, then it is no longer 2FA.
While Twilio does a lot right, they still only offer SMS and their own proprietary Authy solution for 2FA for their website. No TOTP (and still no plan to offer the industry standard) means that this has a whiff of hypocrisy.
The Twilio 2FA API actually allows you to generate secrets and QR codes for generic authenticator applications now. Check out the documentation here: https://www.twilio.com/docs/authy/api/one-time-passwords#oth...
I want a one-step-login. Not two step (first username, then password) and certainly not three step (username, password, 2fa, all in seperate pages). This braindead concept needs to die. If no 2fa is active on the account, just accept anything (including empty strings) in that field.
You could obviously add some info message below or above, but people tend to be terrible at reading.
Maybe if the 2FA input field is below the login button, after some text explaining it’s function..?
I’d love to see some UX test results on this with a bunch of real users of varying tech skill levels.
Hello! I’m the author of this article. Thanks for posting! Here’s to the power of HTML attributes and better sign in experiences for everyone.
Hello! I’m the author of this article. Thanks for posting! Here’s to the power of HTML attributes and better sign in experiences for everyone.
why recommend inputmode if isn't well supported by other browsers that aren't Chrome ?
I'd say that's well supported, especially for the problem it's trying to solve (displaying the best keyboard for the input on mobile devices).
This whole paragraph is incorrect. While the attribute value does allow multiple tokens there is a very specific syntax defined in the HTML standard and it doesn’t support multiple field names (types) i.e. autocomplete="username email" is invalid. If you access ‘input.autocomplete’ on an input with that attribute value “” will be returned indicating this.
> You can use more than one autocomplete value at a time too. If your username is also an email address you can give the browser and any associated password managers a hint with ‘autocomplete="username email"’. This whole paragraph is incorrect. While the attribute value does allow multiple tokens there is a very specific syntax defined in the HTML standard and it doesn’t support multiple field names (types) i.e. aut…
I've updated the post, thank you for your help!
Earlier quoted context omitted.
The Twilio 2FA API actually allows you to generate secrets and QR codes for generic authenticator applications now. Check out the documentation here: https://www.twilio.com/docs/authy/api/one-time-passwords#oth...
The argument then goes back to, why pick up an external dependency and cost for open standard authenticator when you could just include a library and generate it yourself.
But if building and maintaining app based TOTP using a library is good enough for you, then go for it. I'm certainly not going to make you use Twilio's APIs, but plenty of businesses do see the benefit.
Earlier quoted context omitted.
why recommend inputmode if isn't well supported by other browsers that aren't Chrome ?
It's supported in iOS Safari and Chrome / Chrome for Android[1]. I'd say that's well supported, especially for the problem it's trying to solve (displaying the best keyboard for the input on mobile devices). [1] https://caniuse.com/#feat=input-inputmode
You shouldn't find yourself in too much trouble in a browser if you add an attribute to an element that it doesn't understand though, it will just ignore it.