3 ms·

Multi-factor authentication doesn't need a cellular phone. I personally use TOTP codes and security keys whenever I can, as I am very weary of giving away my ph

Multi-factor authentication doesn't need a cellular phone. I personally use TOTP codes and security keys whenever I can, as I am very weary of giving away my phone number (I want to believe this is why I rarely get spam calls or texts). There is an obvious downside to security keys (cannot be backed up or transfer secrets), but passkeys are slowly becoming a viable alternative, which gives you almost the same level of security as security keys implementing FIDO2. Major services like GitHub already allow passkey authentication. Both iOS and Android have supported passkeys for a while now, and so have all of the major browsers (Chrome, Firefox, Safari). So overall, I think passkeys are a good alternative to SMS :)

kredd 3y ago
Now try to explain that to a person in their 70s that are thrice removed from tech industry while they're trying to check their bank account balance. I agree with you 100%, I wish we went for much secure way. Unfortunately UX friction and pre-established ideas will make it way harder to roll out to the general public.
- extraduder_ire 3y ago
  I think 2fa card readers that use your bank card (like the one that goes in an ATM) to generate a code are easier to understand than receiving an SMS. Especially here in chip-and-pin land.
- squigz 3y ago
  Couldn't the same thing have been said for SMS 2FA, and not all that long ago?
  - andrewflnr 3y ago
    Honestly "plug the little black thing in here, rub the gold dot when the screen says" is better ux than typing numbers. Have you ever the heard stories where people aren't able to type in their code before it expires?
- artificialLimbs 3y ago
  Before a very small amount of years ago, we couldn't check our bank account balances by logging onto the internets. We called or visited a bank teller in person. gasp! If a person can't handle 2fa, do they really need to be using online services that are important enough to warrant using 2fa? I imagine the world will advance and this will become easier over time, but for now single player security across wires is complicated.
- mathieuh 3y ago
  In the past I've been given little key fobs with my debit card that give you a 2FA code when you press a button
- miohtama 3y ago
  The EU requires banks to use secure authentication methods and has done so by a directive more than a decade now. This includes one-time passwords and app based two-factor. I do not see how the eldery in the US would need more explanations than in the EU.

kredd 3y ago

Now try to explain that to a person in their 70s that are thrice removed from tech industry while they're trying to check their bank account balance. I agree with you 100%, I wish we went for much secure way. Unfortunately UX friction and pre-established ideas will make it way harder to roll out to the general public.

extraduder_ire 3y ago
I think 2fa card readers that use your bank card (like the one that goes in an ATM) to generate a code are easier to understand than receiving an SMS. Especially here in chip-and-pin land.
squigz 3y ago
Couldn't the same thing have been said for SMS 2FA, and not all that long ago?
- andrewflnr 3y ago
  Honestly "plug the little black thing in here, rub the gold dot when the screen says" is better ux than typing numbers. Have you ever the heard stories where people aren't able to type in their code before it expires?
artificialLimbs 3y ago
Before a very small amount of years ago, we couldn't check our bank account balances by logging onto the internets. We called or visited a bank teller in person. gasp! If a person can't handle 2fa, do they really need to be using online services that are important enough to warrant using 2fa? I imagine the world will advance and this will become easier over time, but for now single player security across wires is complicated.
mathieuh 3y ago
In the past I've been given little key fobs with my debit card that give you a 2FA code when you press a button
miohtama 3y ago
The EU requires banks to use secure authentication methods and has done so by a directive more than a decade now. This includes one-time passwords and app based two-factor. I do not see how the eldery in the US would need more explanations than in the EU.