3 ms·
Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications. We desperately need to have
by uncletammy 5y ago
Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications.
We desperately need to have better MFA options if we're going to require it from users.
- OskarS 5y ago> or a binary that runs on my phone is a deal breaker Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation). “MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.
- mixmastamyk 5y agoFYI: https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password
- NoGravitas 5y agoMFA can't require me to run your specific app is a good guideline, though. It still leaves TOTP as fine, as long as I can choose my implementation.
- Spooky23 5y agoTOTP doesn’t meet the security requirements of higher trust level auth. You’re demonstrating why - storing your MFA with your first factor is pretty dumb. Where I work a bunch of people had a cow about having to put a MFA app on their phones, but refused to take a work phone. Our remedy was to issue them PINs to allow after hours access to the building.