It's strange to be on a crusade against increased security for the average user.
Is 2FA the final answer? No. But are you more secure with it than without it? Yes.
We're talking about normal people here that could have their lives ruined if their accounts are compromised.
What I'm against is people treating "username + password + two-factor" as some high bar of security and usability, suitable even for banking systems (as some users implied before).
My point is that we should be looking at other solutions. Two-factor is a stop-gap measure.
And please don't call other comments "ridiculous". This is not the kind of community I want to participate in, and probably neither do you. Also note I'm not some crank, this is my area of research.
But we don't have discussions like this very often, therefore we don't have a consensus on which solution is the best alternative. I think this is a network effect problem (chicken-and-egg) more than a "perfect is the enemy of good".
Still, it might be a nice incremental improvement.
And note I said "something like SQRL".
I probably wouldn't feel so strongly about it had I not listened to a couple of his podcasts. I had several hours of driving ahead, searched for something that sounded interesting, found his "Security Now" podcast, and downloaded a few episodes. Keep in mind that his audience, AFAICT, is primarily made up of younger listeners who are relatively new to infosec as well as "non-techy" people en masse (the kind of people who get their tech support from a guy on the radio, as someone elsewhere put it). Now, I'm far from a security expert but I'm not exactly a "n00b" and it didn't take long at all until I heard him saying things that were just patently incorrect. When one is repeatedly wrong in an area in which they claim to be an expert, I tend to question their credibility.
Others have found plenty of issues with "SQRL" -- arguably his best idea -- which he simply dismisses and I can still remember when he first presented "GENESIS" to the world.
Oh, and be careful out there on the Internet, as your ISP-assigned reverse DNS "might uniquely identify you on the Internet". IMO, that's right up there with "your computer may be broadcasting your IP address".
Last, remember, he's a marketing guy. That's his real area of expertise. He's certainly better at that than he is anything related to security.
What flaws do you mean?
- Backup is per-website. Every new registration requires you to e.g. print a slip of paper and store it in your safe/friend's house/secret drawer.
- Each website has to implement their own backup flow. That's extra cost, hurts adoption, and some don't even bother with that.
- The PIN is extremely low-entropy, which requires absolutely perfect rate-limiting. As soon as the attacker is able to side-step the rate-limiting (which has a large surface area), the OTP is useless.
- The PIN is vulnerable to shoulder-surfing and surveillance. Can you type the PIN faster than the attacker that's using OCR?
- Typing a PIN number (that has a timer!) adds friction and mental angst.
- And I may be wrong, but as I understand all devices have the same level of trust. If your phone is stolen, it's a race to revoke the thief's codes before they revoke yours. Ideally you should have some "master secret" in your safe/friend's house/secret drawer, that is able to revoke any and all devices because it's the safest secret you have.
- It's only suitable as a second factor, not primary. You are probably also using passwords, which adds a whole lot more security and usability problems.
- SMS is insecure, both from a protocol and from a social engineering point of view. Google Authenticator is better, but still has fatal flaws.
- We use email for casual communication and security-sensitive account changes. This is a disaster. What happens if Google bans your account by mistake, or a thief steals your phone and decides to data-mine/destroy your online life?
- I have yet to see a two factor auth protocol with decent recovery ("I lost my phone") and revocation ("the thief used my phone to login and kick me out"). The instructions are usually "make a new backup for every new account if the site supports" and "tough luck", respectively.
Our online lives are more important than ever. Hearing "I'm sorry, you lost every single online account you ever had" is going to become recurrent unless we change our ways.
IMHO I think the best solution would look something like SQRL (https://www.grc.com/sqrl/sqrl.htm).
EDIT: I'm not against adding two-factor to a website that only has username+password. I personally use two-factor everywhere I can. My point is that this is not a good combo, from a security and usability point of view. But still better than just passwords.