4 ms·

I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usabl

by orev 7y ago

I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.

lukeschlather 7y ago
MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA. Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)
- brnt 7y ago
  Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case. Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens). A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
  - ocdtrekkie 7y ago
    MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.
    - brnt 7y ago
      From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.
worble 7y ago
At some point something has to give though. Security and convenience are constantly at odds with each other. My opinion is that it's far better to convince people that it's worth the inconvenience rather than watering the security down to the point where it's basically pointless. And if they take the consideration that the extra security isn't worth it for them, then that's the choice they make.
davchana 7y ago
I have copied all the 2FA strings in a separate keypass database, with a different password, only in my memory. I also went through writing a simple javascript page to import all those keys to Google Authenticator via totp:// protocol. It takes a csv of all strings, and spits out the html links with totp://protocol. All using local storage only. So whenever I change phone, I paste the csv from keypass to google keep (pretty safe), open it on the new phone, copy it & paste into my html5 app, and click each link and it auto adds itself to Google Authenticator. Then I select all text in Google Keep and delete it.
eikenberry 7y ago
A Yubikey is what you are looking for. https://www.yubico.com/ https://www.yubico.com/

by orev 7y ago

lukeschlather 7y ago

MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA. Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)

brnt 7y ago
Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case. Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens). A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
- ocdtrekkie 7y ago
  MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.
  - brnt 7y ago
    From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.

worble 7y ago

At some point something has to give though. Security and convenience are constantly at odds with each other. My opinion is that it's far better to convince people that it's worth the inconvenience rather than watering the security down to the point where it's basically pointless. And if they take the consideration that the extra security isn't worth it for them, then that's the choice they make.

davchana 7y ago

I have copied all the 2FA strings in a separate keypass database, with a different password, only in my memory. I also went through writing a simple javascript page to import all those keys to Google Authenticator via totp:// protocol. It takes a csv of all strings, and spits out the html links with totp://protocol. All using local storage only. So whenever I change phone, I paste the csv from keypass to google keep (pretty safe), open it on the new phone, copy it & paste into my html5 app, and click each link and it auto adds itself to Google Authenticator. Then I select all text in Google Keep and delete it.

eikenberry 7y ago

A Yubikey is what you are looking for. https://www.yubico.com/ https://www.yubico.com/