3 ms·
Have you seen the prompt system, as used by Google, Micosoft, Okta, et al.? In my strictly personal opinion, responding to a notification that asks if a login
by Kalium 7y ago
Have you seen the prompt system, as used by Google, Micosoft, Okta, et al.?
In my strictly personal opinion, responding to a notification that asks if a login attempt is you is clear enough that people need minimal training to make use of it. This might just be me, though.
In my career, I've definitely seen people actively choose SMS over other factors on offer. It was easier for them, and in many cases shouldn't have been offered. Your point about SMS being better than nothing is wise and true and insightful, but it's perhaps not always the question as faced in practice.
- gowld 7y agoThe problem there is that it's not very clear that you didn't trigger the login yourself.
- Kalium 7y agoIt's been my experience that it's often reasonably clear to users that they did perform a login themselves in the past few seconds. Adding an approximate location and a short verification token to the prompt generally helps. Your experience and standards of clarity may be different from mine, obviously.
- sfifs 7y agoThey (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access. In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets delivered.
- DaiPlusPlus 7y agoHOTP-based 2FA systems (like Google Authenticator) do not require internet connections.
- lol768 7y agoDon't most folks uses TOTP-based schemes with Google Authenticator? Unless you're using HOTP to mean HOTP and all extending schemes.
- davchana 7y agoYeah, and my local walmart has a section where there is no network coverage; I was browsing the store and wanted to check something on my bank app; it prompted me for SMS code, which I didn't receive because of no network; & I would not have received the Google prompt if I needed one for the same reason.
- wwwigham 7y agoI'm pretty sure the Microsoft authenticator has a backup TOTP token you can have it display if you have issues receiving the notification. It is quite a user friendly auth scheme, at least I've never had to resort to any kind of SMS backed auth.
- Kalium 7y agoIn my opinion, that sounds like precisely the sort of system that should not offer an SMS fallback unless the goal is to create a false sense of security in the user. But YMMV, I don't generally need to access my online banking applications when I don't have useful internet access. I tend to use TOTP for systems where I'm concerned about offline usage. But again, YMMV.