4 ms·

I’m stunned there wasn’t an identity verification requirement before. I always just assumed there was. What a clown show. Also, isn’t 2FA based on SMS or TOT

I’m stunned there wasn’t an identity verification requirement before. I always just assumed there was. What a clown show. Also, isn’t 2FA based on SMS or TOTP almost as easy to phish as a password? If someone is already typing their password into a phishing site, that site can just ask for 2FA codes too, right? I’d say make WebAuthn the baseline, but I do that for myself with a YubiKey and it sucks. Mine’s older (v4) and only does U2F, but it doesn’t work over RDP and I have to use my PC for everything. I think a better system would be a hybrid of Microsoft’s push (click approve) system and WebAuthn. Ex: I visit a site and it pushes a WebAuthn challenge to my phone’s authenticator and I approve by NFC using my hardware key. That way you get a signature for a specific domain (ex: microsoft.com) and you only need compatibility for the system on one device; your phone.

kadoban 5y ago
Some SMS and TOTP are vulnerable to phishing, yes (combination with a good password manager reduces/eliminates this). That's not the only attack though, and it's still better than nothing.
atatatat 5y ago
You speak of Webauthn like it isn't wildly new/still being adopted.