News for hackers. Stuff that matters.
Re:Let's Ban SMS 2FA by pcloadletter_ on Sunday February 25, 2024 @11:04PM (#39507531)
>When the barrier to adoption and inconvenience to the user is so low

Is it low though? I'm not sure my parents could figure out how to use an authenticator app.

Re:Let's Ban SMS 2FA by c22 on Sunday February 25, 2024 @11:11PM (#39507584)
I've noticed that for sites I visit rarely there will be some sort of drift from the auth app and I'm often forced to use a backup code.

I'd rather just have a whole list of allowable factors and the opportunity to configure one or more of them depending on my personal risk tolerance.

Re:Let's Ban SMS 2FA by ants_everywhere on Sunday February 25, 2024 @11:46PM (#39507781)
Really though? I get maybe being confused the first time they used it, but you really think they couldn't figure it out?

An authenticator app just has the codes and the sites. SMS has the codes, all the previous codes, all of your other SMSs. Plus the messages come from a 5 digit phone number that has a similar format to the 6-digit code you're supposed to enter. The whole system is byzantine IMO and the authenticator app has a much simpler flow. But, you know, I recognize that not everyone may experience it the same way.

I'm generally curious if people think there's a simplicity to the SMS approach other than just familiarity with something that's awkward.

The real problem IMO is not that it's hard to use an authenticator app, it's that the authenticator app provides an actual secret. There's less of a backdoor, so customers can lock themselves out. The downside of the backdoor is it's a security risk. The upside is that managing private keys is a nightmare and nobody wants to force their customers to actually manage private keys.

Re:Let's Ban SMS 2FA by dtx1 on Sunday February 25, 2024 @11:12PM (#39507588)
Then your Patents should not be near any account that should reasonably require 2FA. They are perfect prey for scammers.