2 ms·
> a phone is not a good 2nd factor for authentication That's an argument for a phone not being the best 2FA mechanism. The argument for phones as 2FA isn't pr
by ajross 4y ago
> a phone is not a good 2nd factor for authentication
That's an argument for a phone not being the best 2FA mechanism. The argument for phones as 2FA isn't predicated on them being optimal, it's predicated on them being (1) present in almost all cases and (2) easily used.
Obviously yes, it would be safer if we'd all carry around password-locked yubikeys. But we aren't going to. We do have phones in our pockets, though.
- sublinear 4y agoSince phones are now the primary computing device for most people, is it really a "2nd factor" though?
- ajross 4y agoAs conventionally defined, yes. The "first factor" is traditionally a password (or in the modern world, maybe password+working_email_address).
- Y_Y 4y agoYou are techincally correct, the best kind of correct, but just for balance I should mention that cavaliers like me end up merging the factors by having all their logins saved on their phones (modulo fingerprint prompts etc.).
- sublinear 4y agoSomething you have and something you know, yes. But isn't the thing you have supposed to be separate from the client you're using to authenticate? We're talking about the case where the phone is stolen. There's almost no reason to steal an authentication device other than harassment or tactical delay of access.