3 ms·
By the way I think that we should phase out password anyway, I mean that I prefer to implement in the applications that I develop a password-less authentication
by matthewmacleod 6y ago
By the way I think that we should phase out password anyway, I mean that I prefer to implement in the applications that I develop a password-less authentication: when you want to sign in a mail (or an SMS) is sent to you, you click on a link with a temporary token and you are authenticated.
Please don’t do this. For one thing, SMS is fundamentally broken as a secure delivery method. But more than that… it’s just so, so deeply annoying.
- oneplane 6y agoBut how will you log in to your SMS inbox? With an email? But what if that requires an SMS inbox as well. Once we're in the realm of 'you only have to remember this one password' you might as well use a password manager that unlocks with that password and does the rest for you (be it with autofill or webauthn and the likes). Yubikeys are fine too, even as a single factor in some cases.
- weavie 6y agoI worked in an office that had no mobile signal. So for me a 2fa SMS involved walking out of the office and down the road for a few minutes until the SMS came through and then running back to my desk in the hope that I get there in time to enter the code before it times out.
- ed25519FUUU 6y agoNo WiFi calling??
- throwit4tonight 6y agoYou may not be able to get your phone on the corporate network without installing their MDM, and you may not want to give your employer the ability to wipe your phone.
- xeromal 6y agoOr the ability to glean what you do on your phone!
- IshKebab 6y agoSupport for that is very uneven. Most UK networks only support it if you have an iPhone or a Samsung phone, and sometimes only if you bought the phone from the network directly.
- three_legs 6y agoIt's disturbingly annoying, I agree