News for hackers. Stuff that matters.

A comment on Ask HN: How can techies influence companies to stop implementing SMS/phone 2FA.

Re:Ask HN: How can techies influence companies to stop imple... by alistairSH on Wednesday November 02, 2022 @10:19AM (#33436211)
Why? MFA via SMS is the most user friendly option at this point. Nothing else comes close.

The Apple flow... - Visit site/app - Clock "send code to phone" - Apple populates code field with code when it arrives

No 3rd party app, no extra subscription, no extra hardware. Couldn't be much easier.

Yes, I realize SMS can be attacked in a few ways that app- or hardware-based MFA cannot. But, it's probably better than nothing (I've not seen a good counter to it).

Now, should banks offer SMS + app/hardware options? Absolutely. No question. But please don't take away SMS unless you're offering something just as easy.

[ Parent | on HN ]
Re:Ask HN: How can techies influence companies to stop imple... by uncletammy on Wednesday November 02, 2022 @11:03AM (#33436974)
Because privacy. Name any company with an online presence that asks for their user's phone number and I'll give you five reasons why that company can't be trusted with it. Data of this nature is a liability and should be treated as such.
[ Parent | on HN ]
Re:Ask HN: How can techies influence companies to stop imple... by alistairSH on Wednesday November 02, 2022 @01:13PM (#33439379)
Fair enough, but I'm still waiting for an alternative that's as low-touch for non-techies.

And I'll still take SMS over "send the code to some other device that may or may not be within reach" which is one of the common alternatives. It's annoying enough at home, but if I'm on vacation or at the office, having codes sent to my iPad is a non-starter.

[ Parent | on HN ]