With TOTP, you can put the TOTP code in your password manager with all your other passwords, which is probably what I will do it it catches on. It's effectively one factor at that point. (Do you know my password manager's password?)
Adorable. Please show me a bank, utility provider, brokerage, widely-used P2P money transmission service, and phone provider that each offers WebAuthN (without a mandatory fallback to SMS-2FA).
There is absolutely no "free market" for authentication methods: Everybody does almost exactly the same thing, as authentication probably does not even make their top 10 business priorities.
Bank: Most banks in the UK use an industry standard Chip Authentication Program - which uses the bank card's chip rather than SMS 2FA https://en.wikipedia.org/wiki/Chip_Authentication_Program
P2P Money: Coinbase https://www.yubico.com/gb/works-with-yubikey/catalog/coinbas...
Brokerage: Vanguard https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar...
It would be a bit odd to have a mobile phone provider who doesn't support SMS. But looks like Vodafone is hiring someone with WebAuthN experience https://opportunities.vodafone.com/job/Dusseldforf-Solution-...
Hope that helps.
Ah, your earlier statement ("you live in a free market") implied otherwise. Maybe something worth considering before asserting that there is free market choice in all of these industries.
For banks, it is not that easy and convenient. I like my banks for many reasons except the 2FA thing. Most banks at least in US are still doing SMS 2FA. I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way.
Start a coordinated shitstorm against these banks because of this. Banks (as many companies) are often very concerned about their reputation.
Haha. Banks are only concerned about their relative reputation. If all their peers are screwing the consumer, they don't care at all.
https://arstechnica.com/tech-policy/2022/10/zelle-fraud-is-o...
That's literally the point of capitalism. Organisations are free to offer any service they like and customers can choose which one best meets their needs. If enough people move to the one offering better 2FA then the others will follow.
Having the government force companies to behave in a certain way sounds dangerously close to socialism to me.
I'm sticking with Schwab for now because they are at least vish resistant. I have a 'verbal passphrase' and support will not help "me" unless I provide it.
That is exactly what I did. I was with a major bank but they would not take my security seriously and only did 2FA. I moved to a small local bank that allowed me to lock down my accounts so that from the internet they are read-only. I have to physically go into the bank and show ID for most of my accounts. That leaves one account I can use for small online purchases.
I am working with them to implement better security around ACH/wire transfers. That's not even a discussion I could have with the bigger banks.
TOTP codes can be shared between multiple devices - which makes them less unique than an SMS to a specific MSISDN. Your ability to back up a code doesn't necessarily mean you have the ability to store it securely.
FIDO tokens can also be lost.
I don't know why you're asking for your congress to fix this. You live in a free market, so move your business to someone who you think takes security seriously.