Re:Your Mother’s Maiden Name Is Not a Secret
by u801e on Saturday December 30, 2017 @02:36PM
(#16037023)
The key fob (or equivalent application on one's phone) is a better option compared to email/SMS based 2FA since the latter is not secure [1] [2]). The latter is still a lot like the half-baked security measures I mentioned in my earlier post.
I still think having certificate/private key imported into my browser as a one-time (or periodic) task more convenient compared to having to use a key fob or soft token from a phone app everytime I have to log in.
[1] https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s...
[2] It's a general problem of people using the same password for one's email account or cell phone service account and their online bank account
I don't think most users would have a terrible time. I think most users would not bother with setting up anything fancy, but could if they had ok instructions. But I think there are many who would absolutely flounder. As a technical person, I would like more security for sure.
"Security" questions should be gone. Everything important should be 2FA or have a key fob. I think just about everyone who has a phone and does online banking can understand "input the code we just texted you."