Re:You don’t need SMS-2FA
by packet_nerd on Wednesday July 29, 2020 @02:32PM
(#23990074)
Except it's not really a sliding scale with SMS being "easy" and U2F being "hard". U2F is SO much more convenient than either TOTP or SMS. SMS might be a little easier than TOTP, but with either one you still have to (1) find the phone, (2) unlock it, (3) hunt around for and open the app, (4) manually type the code in, often looking back and forth between the phone and webpage 2 or more times before you get it. Compare to just taping the U2F key with the side of your finger (assuming it's already plugged in, which is what I do). There's just no comparison in terms of UX between U2F and anything else I've ever seen.
[ Parent
| on HN ]
Can you use the same USB key for every application you need to authenticate to?
Re:You don’t need SMS-2FA
by tialaramex on Wednesday July 29, 2020 @04:17PM
(#23991100)
Web sites can all just do WebAuthn. The browser will securely manage the relationship between each site and the USB key ensuring that sites can't lie to the key about who they are (which would enable phishing).
If you are happy to use this only as a second factor, the USB key can handle any number of sites without constraint. If you want "resident credentials" where the USB key can sign you in spontaneously (no need to even enter a username or email address) the key needs storage for each such credential, those on the market today hold only a relatively small number, fine for your bank but not for say Hacker News and other forum sites you might join dozens of.
For other application software it's trickier but possible, you can see that OpenSSH did this for example.
Re:You don’t need SMS-2FA
by packet_nerd on Friday July 31, 2020 @02:19PM
(#24011810)
Yes
(If the service supports U2F)