3 ms·

I think you need to re-visit your SMS support decision. SMS for 2FA is not secure, at all.

• KevinMcGovern 9y ago
  We are working on other authentication methods and we'll be releasing OTP auth within the next few weeks, however the decision to start with SMS was based primarily on accessibility. Adoption of other authentication methods has been slow (despite warnings from agencies like NIST), and I don't believe the solution to that is to force it and drop SMS immediately and entirely. It's going to require education over time to convince both users and developers that other methods of authentication need to be adopted. In the meantime, I think we need to meet them where they're currently looking, get them to start using some form of 2FA, and convince them of the benefits of moving to more secure methods from there. As we've been working on this we've been brainstorming different approaches we could take to help facilitate that adoption. It could be in the form of more favourable pricing, or even just a content strategy that encourages more secure methods, but I'd love to hear your thoughts on the subject.
  • stephenr 9y ago
    Given that SMS is already considered insecure, my thoughts are that it's too late to be starting a new service offering it, saying "we need to educate users first".