HTML attributes to improve your users' two factor authentication experience

Re:HTML attributes to improve your users' two factor authent... by latchkey on Sunday January 12, 2020 @07:50AM (#22026062)

Ok, makes sense. Thank you for the kind response and I approve of most of it. I think we will have to agree to disagree on the last * though. I think that statement is very much 'it depends.'

I apologize for going in circles one more time... but by not providing 2FA SMS, it is impossible to f'ck it up or be abused. Right?

[ Parent | on HN ]

Re:HTML attributes to improve your users' two factor authent... by philnash on Monday January 13, 2020 @08:17PM (#22040799)

I shy away from any rules that say you can’t mess something up simply by avoiding one thing, especially in this sort of case. Consider also that avoiding 2FA by SMS may avoid sim swap or recycle attacks, but it could also eliminate 2FA for users who don’t have a device capable of running an authenticator application (a feature phone).

There’s a lot more at play here, and “just don’t” isn’t a nuanced enough answer to 2FA by SMS.

[ Parent | on HN ]