3 ms·
Can we decide to band together as an industry and call this “zero factor authentication,” since you login without using something you know or something you own/
by hedora 3y ago
Can we decide to band together as an industry and call this “zero factor authentication,” since you login without using something you know or something you own/control?
The only way I can think of to explain this to a non-techie is “your account is now tied to your [singular] device, and neither a password nor a replacement device (like a new sim card) will let you in.”
So, it really does remove both factors from 2FA, and the logical conclusion holds.
Either anyone can get into an account with a “I broke my phone” social engineering attack, or the account owner cannot reliably authenticate.
- echeese 3y agoSomething you have: Your phone Something you know: Your pin Something you are: Your FaceID/Fingerprint
- hedora 3y agoFaceID and pins just unlock the secure enclave, which stores the password^H^H^H^Hkey on the phone that will eventually break. So, when you are holding your dead phone, you realize that there is nothing you know or have that will let you into the account (and there never was such a thing).