3 ms·
The alternative is passkeys, which are strongly phishing-resistant and don't require an annoying "second factor" step for the user at all.
by jesseendahl 3y ago
The alternative is passkeys, which are strongly phishing-resistant and don't require an annoying "second factor" step for the user at all.
- drdaeman 3y agoWhile true and while absolutely better from the security and privacy standpoints, aren't passkeys less inclusive than SMS 2FA? Honest question - I'm not sure. I can see them being more both less and more inclusive: it's somewhat more inclusive because they don't require any monetary payments on a monthly basis to keep the phone number active, but it's also most likely significantly less in terms of adoption. Also, passkeys don't provide a way to perform non-Internet authentication. Like when you call your bank or they call you, you cannot use a passkey to authenticate each other purely over the phone, you need to be online. While this is surely technically possible to do over the phone (or postal pigeons -- j/k), it's not even on a radar and is extremely unlikely to ever happen in any foreseeable future.