How do you handle 2FA?

Re:How do you handle 2FA? by chinathrow on Tuesday October 26, 2021 @03:47PM (#29005363)

I complain to anyone offering SMS 2FA.

> PS - I am ideating on a 2FA method using cryptography where the user will not need internet on his phone.

If the user needs to be loggedin somewhere, they must be online. So it's safe to assume their phone has a connection too.

[ Parent | on HN ]

Re:How do you handle 2FA? by PranavBerry on Tuesday October 26, 2021 @04:06PM (#29005592)

> If the user needs to be loggedin somewhere, they must be online

I will be using JWTs, with asymmetric signatures. An internet connection will only be needed while adding the device for 2FA. The JWT will be generated from the private key already on the phone so internet is not necessary.

[ Parent | on HN ]

Re:How do you handle 2FA? by chinathrow on Tuesday October 26, 2021 @04:28PM (#29005842)

What problem are you solving? I don't get it.

[ Parent | on HN ]

Re:How do you handle 2FA? by PranavBerry on Tuesday October 26, 2021 @04:48PM (#29006063)

If the phone not having a internet/network coverage was a problem, my idea could be useful. It also makes the phone a kind of hardware token, a user can login only if he has his phone.

However from the responses it looks like this is not an issue and I'll probably not work further on this idea.

[ Parent | on HN ]

Re:How do you handle 2FA? by chinathrow on Wednesday October 27, 2021 @03:46AM (#29010584)

Yeah I really think it's a non-issue: 2FA apps such as Authy or Google Authenticator already work if the phone is offline.

[ Parent | on HN ]

Re:How do you handle 2FA? by stephenr on Wednesday October 27, 2021 @02:14AM (#29010066)

That isn't a safe assumption at all.

A very well known issue with old SMS based OTP, is that they can stop working when the user is overseas.

[ Parent | on HN ]