Re:Tell HN: SMS-based two-factor authentication is not secure
by staticassertion on Wednesday June 09, 2021 @10:01AM
(#27447919)
> Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.
So then have two U2F tokens. Or use your phone's TPM as a U2F token. The usability of phone-based U2F is quite good.
Re:Tell HN: SMS-based two-factor authentication is not secure
by Wowfunhappy on Wednesday June 09, 2021 @10:18AM
(#27448141)
A phone's TPM is the only U2F token that 99% of the world owns, assuming they own one at all.
Re:Tell HN: SMS-based two-factor authentication is not secure
by staticassertion on Wednesday June 09, 2021 @10:25AM
(#27448236)
Yes, as I've said, availability is the problem to solve. We should be shipping U2F tokens wherever we can. I'd like to see schools that require students to use GSuite and other U2F supporting sites giving students tokens for free. I'd like to see banks giving their customers tokens. I'd like to see companies giving them to employees.
IMO the problem is not "let's get some kind of 2FA" it's "let's get U2F in the hands of as many people as we can".
Re:Tell HN: SMS-based two-factor authentication is not secure
by tsimionescu on Wednesday June 09, 2021 @01:04PM
(#27450363)
Most people don't own two phones though, and wouldn't think to have two separate U2F tokens.
Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.