4 ms·

Agreed. My day job is in fintech. Our average customer age is > 60. Explaining 2fa via SMS to that age group is hard enough. Adding authenticators or QR codes

Agreed. My day job is in fintech. Our average customer age is > 60. Explaining 2fa via SMS to that age group is hard enough. Adding authenticators or QR codes into the mix would blow their frail minds.

hocuspocus 4y ago
60 is not old. And I don't think age is particularly relevant here. Today millions of people are using PSD2 compliant SCA (that should not rely on SMS tokens only) in Europe. Usually implemented by a push notifications that you need to approve using biometrics on your smartphone.
- Shish2k 4y ago
  > I don't think age is particularly relevant here. “What technology you grew up with” is definitely a factor (not the only factor, but a big one) in “what technology you feel comfortable using”.
  - warner25 4y ago
    I used to say that I'm determined to not let technology pass me by with age, but now I suspect that it will happen someday anyway, despite being a technologist. I'm recognizing my aversion to newer, trendy things more and more. I often wonder where the line will finally be drawn and when I'll cross it. Maybe if companies start pushing something like video and gesture-based authentication in virtual or augmented reality, I'll be the old guy saying "you can pry passwords and email from my cold, dead hands."
izacus 4y ago
Why do your other users need to suffer just because you have 60+ people too? How is that for an excuse to not provide better options?
t-3 4y ago
A physical key is much more intuitive than typing a code. It's directly analogous to a locked room.
- hn_throwaway_99 4y ago
  1. And physical keys get lost all the time. So then you need to solve the "lost key problem", and proving identity then means you're often vulnerable to the same types of things that make sim jacking a problem in the first place (to be clear, though, I think the much bigger benefit of physical keys is their resistance to phishing, not their resistance to sim jacking). 2. Actual physical keys are expensive. The margins on many types of depository accounts are razor thin, and giving everyone a physical key would be significant. 3. So an option to #2 is then to use the physical key built into nearly all smartphones these days. But I can definitely say that, at present, that option still doesn't work that great. Have had loads of problems using a phone key with Google's Advanced Protection, many times bugs on Google's part. Also, this normally depends on bluetooth, which can have a ton of connection issues.

hocuspocus 4y ago

60 is not old. And I don't think age is particularly relevant here. Today millions of people are using PSD2 compliant SCA (that should not rely on SMS tokens only) in Europe. Usually implemented by a push notifications that you need to approve using biometrics on your smartphone.

Shish2k 4y ago
> I don't think age is particularly relevant here. “What technology you grew up with” is definitely a factor (not the only factor, but a big one) in “what technology you feel comfortable using”.
- warner25 4y ago
  I used to say that I'm determined to not let technology pass me by with age, but now I suspect that it will happen someday anyway, despite being a technologist. I'm recognizing my aversion to newer, trendy things more and more. I often wonder where the line will finally be drawn and when I'll cross it. Maybe if companies start pushing something like video and gesture-based authentication in virtual or augmented reality, I'll be the old guy saying "you can pry passwords and email from my cold, dead hands."

izacus 4y ago

Why do your other users need to suffer just because you have 60+ people too? How is that for an excuse to not provide better options?

t-3 4y ago

A physical key is much more intuitive than typing a code. It's directly analogous to a locked room.

hn_throwaway_99 4y ago
1. And physical keys get lost all the time. So then you need to solve the "lost key problem", and proving identity then means you're often vulnerable to the same types of things that make sim jacking a problem in the first place (to be clear, though, I think the much bigger benefit of physical keys is their resistance to phishing, not their resistance to sim jacking). 2. Actual physical keys are expensive. The margins on many types of depository accounts are razor thin, and giving everyone a physical key would be significant. 3. So an option to #2 is then to use the physical key built into nearly all smartphones these days. But I can definitely say that, at present, that option still doesn't work that great. Have had loads of problems using a phone key with Google's Advanced Protection, many times bugs on Google's part. Also, this normally depends on bluetooth, which can have a ton of connection issues.