Re:A Guide to WebAuthn
by toastal on Sunday January 05, 2020 @10:17PM
(#21966136)
Phones are one of the most likely things to break given their usage. So then you'd be locked out of the account. Requiring a smart phone or a phone number to authenticate but a high bar in certain regions of the world as well as against privacy-conscious people.
Here's a anecdote about phone and required 2FA: I was in Laos needing to pay rent when my phone broke. I was locked out of TransferWise to get my paycheck because their 2FA is behind their proprietary app so I couldn't authenticate on my laptop. Luckily I had just enough cash in my bank account. Too bad the bank only had 2 2FA options; 1) behind their proprietary app which doesn't allow rooted devices (despite root for more privacy tools on Android) or 2) SMS in which I was in another country so I didn't have access to my home SIM.
Because I needed a new phone to fix this issue, I went to buy a new one online. I couldn't pay for it because I needed a working phone to confirm a payment with my bank.
All of this could be solved by allowing TOTP (which doesn't require a phone) or FIDO2 (which I have a key).
Here's a anecdote about phone and required 2FA: I was in Laos needing to pay rent when my phone broke. I was locked out of TransferWise to get my paycheck because their 2FA is behind their proprietary app so I couldn't authenticate on my laptop. Luckily I had just enough cash in my bank account. Too bad the bank only had 2 2FA options; 1) behind their proprietary app which doesn't allow rooted devices (despite root for more privacy tools on Android) or 2) SMS in which I was in another country so I didn't have access to my home SIM.
Because I needed a new phone to fix this issue, I went to buy a new one online. I couldn't pay for it because I needed a working phone to confirm a payment with my bank.
All of this could be solved by allowing TOTP (which doesn't require a phone) or FIDO2 (which I have a key).