4 ms·

> There's a fingerprint reader on my laptop, face id on my phone, and a yubikey in my USB. Great! Not everyone has that! I do but if I could only implement one

> There's a fingerprint reader on my laptop, face id on my phone, and a yubikey in my USB. Great! Not everyone has that! I do but if I could only implement one type of 2FA I'd probably still pick SMS.

chrispeel 3y ago
Everyone can get an app on their phone or computer that supports TOTP, such as Google Authenticator https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password
- gruez 3y ago
  What happens when they smash their phone and now you have to do account recovery? With SMS authentication you can presumably offload that to the carrier.
- supertrope 3y ago
  The problem is customer support load. Also what does the company do about those without a smartphone? No smartphone no service? This is why businesses peg account authentication to phone numbers. It offloads IAM overhead to phone companies.
  - pdntspa 3y ago
    Who cares. Spend the money on customer service people then. Companies don't need all the profits they make and investors dont need their 10000x returns when 9900x will do just fine.
    - supertrope 3y ago
      Here we are on a website centered on an industry that has "solved" customer support by having zero live support. It's RTFM (or FAQ). Sometimes even paying customers get this treatment.
torstenvl 3y ago
Far far more people have a biometric reader or smart token than have a cell phone. Smart phones are obviously phones and have biometrics. What you're left with is comparing the number of people with non-smart phones (~31 million in the U.S.) to the number of people without smartphones but who have biometric tablets, Windows Hello-enabled computers, PIV cards, etc.
- kevml 3y ago
  Do you have statistics on the number of people who do not have smart phones but do have these other devices? I am not sure the intersection is as high as you imply.
  - torstenvl 3y ago
    The only people who don't use smartphones and don't have an iPad or similar tablet and don't have a recent computer... probably don't benefit enough from 2FA to justify the risk of account lockout. In my social circle, the people who don't have smart phones are: - People with disabilities that make reading from a small screen or texting a lot impractical. - People who work in harsh environments who want something more rugged than a device made out of glass. - People wary of the distraction of carrying around an entertainment device. All of these people except one also have an iPad (especially the first group, as the larger screens help a lot). The one who doesn't does have a Dell XPS 13.
- ranger_danger 3y ago
  [flagged]
  - abdulmuhaimin 3y ago
    [flagged]
    - ranger_danger 3y ago
      the sheer number of even just active phones in the world right now, vastly outnumbers the amount of biometric/card readers ever made, combined.

chrispeel 3y ago

Everyone can get an app on their phone or computer that supports TOTP, such as Google Authenticator https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password

gruez 3y ago
What happens when they smash their phone and now you have to do account recovery? With SMS authentication you can presumably offload that to the carrier.
supertrope 3y ago
The problem is customer support load. Also what does the company do about those without a smartphone? No smartphone no service? This is why businesses peg account authentication to phone numbers. It offloads IAM overhead to phone companies.
- pdntspa 3y ago
  Who cares. Spend the money on customer service people then. Companies don't need all the profits they make and investors dont need their 10000x returns when 9900x will do just fine.
  - supertrope 3y ago
    Here we are on a website centered on an industry that has "solved" customer support by having zero live support. It's RTFM (or FAQ). Sometimes even paying customers get this treatment.

torstenvl 3y ago

Far far more people have a biometric reader or smart token than have a cell phone. Smart phones are obviously phones and have biometrics. What you're left with is comparing the number of people with non-smart phones (~31 million in the U.S.) to the number of people without smartphones but who have biometric tablets, Windows Hello-enabled computers, PIV cards, etc.

kevml 3y ago
Do you have statistics on the number of people who do not have smart phones but do have these other devices? I am not sure the intersection is as high as you imply.
- torstenvl 3y ago
  The only people who don't use smartphones and don't have an iPad or similar tablet and don't have a recent computer... probably don't benefit enough from 2FA to justify the risk of account lockout. In my social circle, the people who don't have smart phones are: - People with disabilities that make reading from a small screen or texting a lot impractical. - People who work in harsh environments who want something more rugged than a device made out of glass. - People wary of the distraction of carrying around an entertainment device. All of these people except one also have an iPad (especially the first group, as the larger screens help a lot). The one who doesn't does have a Dell XPS 13.
ranger_danger 3y ago
[flagged]
- abdulmuhaimin 3y ago
  [flagged]
  - ranger_danger 3y ago
    the sheer number of even just active phones in the world right now, vastly outnumbers the amount of biometric/card readers ever made, combined.