Re:What happens to a smartphone when it gets stolen?
by sublinear on Sunday December 11, 2022 @10:00AM
(#33943736)
Since phones are now the primary computing device for most people, is it really a "2nd factor" though?
Re:What happens to a smartphone when it gets stolen?
by ajross on Sunday December 11, 2022 @11:08AM
(#33944363)
As conventionally defined, yes. The "first factor" is traditionally a password (or in the modern world, maybe password+working_email_address).
Re:What happens to a smartphone when it gets stolen?
by sublinear on Sunday December 11, 2022 @06:38PM
(#33948888)
Something you have and something you know, yes. But isn't the thing you have supposed to be separate from the client you're using to authenticate?
We're talking about the case where the phone is stolen. There's almost no reason to steal an authentication device other than harassment or tactical delay of access.
Re:What happens to a smartphone when it gets stolen?
by Y_Y on Sunday December 11, 2022 @11:44AM
(#33944741)
You are techincally correct, the best kind of correct, but just for balance I should mention that cavaliers like me end up merging the factors by having all their logins saved on their phones (modulo fingerprint prompts etc.).
That's an argument for a phone not being the best 2FA mechanism. The argument for phones as 2FA isn't predicated on them being optimal, it's predicated on them being (1) present in almost all cases and (2) easily used.
Obviously yes, it would be safer if we'd all carry around password-locked yubikeys. But we aren't going to. We do have phones in our pockets, though.