3 ms·
I complain to anyone offering SMS 2FA. > PS - I am ideating on a 2FA method using cryptography where the user will not need internet on his phone. If the user
by chinathrow 5y ago
I complain to anyone offering SMS 2FA.
> PS - I am ideating on a 2FA method using cryptography where the user will not need internet on his phone.
If the user needs to be loggedin somewhere, they must be online. So it's safe to assume their phone has a connection too.
- PranavBerry 5y ago> If the user needs to be loggedin somewhere, they must be online I will be using JWTs, with asymmetric signatures. An internet connection will only be needed while adding the device for 2FA. The JWT will be generated from the private key already on the phone so internet is not necessary.
- chinathrow 5y agoWhat problem are you solving? I don't get it.
- PranavBerry 5y agoIf the phone not having a internet/network coverage was a problem, my idea could be useful. It also makes the phone a kind of hardware token, a user can login only if he has his phone. However from the responses it looks like this is not an issue and I'll probably not work further on this idea.
- chinathrow 5y agoYeah I really think it's a non-issue: 2FA apps such as Authy or Google Authenticator already work if the phone is offline.
- stephenr 5y agoThat isn't a safe assumption at all. A very well known issue with old SMS based OTP, is that they can stop working when the user is overseas.