3 ms·

I understand your frustration, but we do not yet have a universal platform to facilitate OTP. There is also hesitation about using SMS for OTP as it is trivial

I understand your frustration, but we do not yet have a universal platform to facilitate OTP. There is also hesitation about using SMS for OTP as it is trivial to take over a persons phone number. Not everyone has a smart phone, myself included. I believe the issue is a bit more complex than passwords vs. OTP. Also there is the issue of not all services not supporting OTP, SAML, OAuth, etc. Things are slowly evolving in that direction, but there will be services that require passwords for a very long time. There are still services that do not even support encryption. All of that said, you could certainly provide an incentive to your user base to use MFA/OTP. Blizzard did this by giving players more inventory space if they enabled SMS and hardware tokens on their account. That won't convert everyone and they still have to support password algorithms.

arturgrigio 8y ago
From a customer's perspective why wouldn't someone opt into this model? You're telling me I don't have to remember an extra password to log in... AND, if a service gets hacked, it's only them that got hacked; I don't have to go across all sites where I reused that password and change it. The burden of security is not on the customer any more. And I get your point about MFA. But, that's it, MFA just adds another step for me to get where I was going. But my proposal removes a step. But you're right about SMS being easy to hack. More thinking is required on that end.
- LinuxBender 8y ago
  >From a customer's perspective why wouldn't someone opt into this model? My theory is that contributing factors are psychological, cultural and environmental. I don't have a lot of data to back up my theories, but I do have anecdotal evidence that people are creatures of habit and conditioning. I see it around me all the time. I can provide people with a simple technical solution; but if it deviates from their normal pattern, a majority will reject it. It has to meet multiple criteria. Lower friction (you did this part), follow a pattern (this is where I believe psychology comes into play), gain popularity (peer pressure, cool kids are doing it). There are probably many other factors and my theories about why adoption of such things may be off. Hopefully others with more economic, marketing and psychology backgrounds can correct or amend my theories.

arturgrigio 8y ago

From a customer's perspective why wouldn't someone opt into this model? You're telling me I don't have to remember an extra password to log in... AND, if a service gets hacked, it's only them that got hacked; I don't have to go across all sites where I reused that password and change it. The burden of security is not on the customer any more. And I get your point about MFA. But, that's it, MFA just adds another step for me to get where I was going. But my proposal removes a step. But you're right about SMS being easy to hack. More thinking is required on that end.

LinuxBender 8y ago
>From a customer's perspective why wouldn't someone opt into this model? My theory is that contributing factors are psychological, cultural and environmental. I don't have a lot of data to back up my theories, but I do have anecdotal evidence that people are creatures of habit and conditioning. I see it around me all the time. I can provide people with a simple technical solution; but if it deviates from their normal pattern, a majority will reject it. It has to meet multiple criteria. Lower friction (you did this part), follow a pattern (this is where I believe psychology comes into play), gain popularity (peer pressure, cool kids are doing it). There are probably many other factors and my theories about why adoption of such things may be off. Hopefully others with more economic, marketing and psychology backgrounds can correct or amend my theories.