5 ms·

I work with a few older employees. Its takes them longer to focus on the words on the screen and to read them (presbyopia happens). It takes longer to get into

I work with a few older employees. Its takes them longer to focus on the words on the screen and to read them (presbyopia happens). It takes longer to get into an app and read a code out. By the time they are ready the code is already changing in the app. It is much easier for them to touch an acknowledgement. We want security but we do not want to make security an impossible barrier for folks that need a little extra time (for whatever reason).

amenghra 5y ago
Semi related: apps which display TOTP tokens should start their timer when the user opens the app (so the code doesn't change 5s after opening the app). The server in the backend is checking the previous+next N tokens anyways since the server needs to account for clocks not being 100% synchronized.
- hunter2_ 5y ago
  Unless the authenticator app was already open, in which case skipping to the next token should be possible on demand. Alternatively, we just found the semantic use case for the <marquee> tag: a properly calibrated scrolling ticker would give readers the clear option (regardless of initial phase) to start reading the newest token or continue reading an older one, as the ideal selection may evolve unexpectedly based on distractions.
ThePowerOfFuet 5y ago
The code is valid for another full minute, typically, after it's rotated for a new one. This isn't much of a valid reason to prefer notification-based 2FA.
- annoyingnoob 5y ago
  It is not obvious to everyone that a code may still be valid after its gone from your screen. You cannot use the first 3 digits from one code and the last 3 from another, so you start over when you don't have all 6 digits before the code changes on you. Different strokes for different folks. I care to have folks be successful.
  - ThePowerOfFuet 5y ago
    This sounds like an education issue; if you were to say "wait until the code changes, then go for it", they have thirty seconds to read and type six digits. If this still doesn't work for them, perhaps a hardware token they can tap might be a better solution.
- makeitdouble 5y ago
  TBF the code still being valid doesn’t help much if the user hasn’t memorized and/or finished typing it all. Sitting next to some family members, they really can’t remember more than one or two letters at a time, and will peck and hunt each of it. Except if they were typing the last digit, the code disappearing from screen is basically the end of it for them.
  - ThePowerOfFuet 5y ago
    In cases like these, I tell them "wait until the code changes, then go for it", so that they have thirty full seconds to read and type six digits. If this still doesn't work for them, perhaps a hardware token they can tap might be a better solution.
- PeterisP 5y ago
  There certainly are people for whom "a full minute" is not sufficient - accessibility is important.
  - ThePowerOfFuet 5y ago
    If you were to tell them "wait until the code changes, then go for it", they would have thirty seconds to read and type six digits. If this still doesn't work for them, perhaps a hardware token they can tap might be a better solution.

amenghra 5y ago

Semi related: apps which display TOTP tokens should start their timer when the user opens the app (so the code doesn't change 5s after opening the app). The server in the backend is checking the previous+next N tokens anyways since the server needs to account for clocks not being 100% synchronized.

hunter2_ 5y ago
Unless the authenticator app was already open, in which case skipping to the next token should be possible on demand. Alternatively, we just found the semantic use case for the <marquee> tag: a properly calibrated scrolling ticker would give readers the clear option (regardless of initial phase) to start reading the newest token or continue reading an older one, as the ideal selection may evolve unexpectedly based on distractions.

ThePowerOfFuet 5y ago

The code is valid for another full minute, typically, after it's rotated for a new one. This isn't much of a valid reason to prefer notification-based 2FA.

annoyingnoob 5y ago
It is not obvious to everyone that a code may still be valid after its gone from your screen. You cannot use the first 3 digits from one code and the last 3 from another, so you start over when you don't have all 6 digits before the code changes on you. Different strokes for different folks. I care to have folks be successful.
- ThePowerOfFuet 5y ago
  This sounds like an education issue; if you were to say "wait until the code changes, then go for it", they have thirty seconds to read and type six digits. If this still doesn't work for them, perhaps a hardware token they can tap might be a better solution.
makeitdouble 5y ago
TBF the code still being valid doesn’t help much if the user hasn’t memorized and/or finished typing it all. Sitting next to some family members, they really can’t remember more than one or two letters at a time, and will peck and hunt each of it. Except if they were typing the last digit, the code disappearing from screen is basically the end of it for them.
- ThePowerOfFuet 5y ago
  In cases like these, I tell them "wait until the code changes, then go for it", so that they have thirty full seconds to read and type six digits. If this still doesn't work for them, perhaps a hardware token they can tap might be a better solution.
PeterisP 5y ago
There certainly are people for whom "a full minute" is not sufficient - accessibility is important.
- ThePowerOfFuet 5y ago
  If you were to tell them "wait until the code changes, then go for it", they would have thirty seconds to read and type six digits. If this still doesn't work for them, perhaps a hardware token they can tap might be a better solution.