4 ms·
The main problem here is that a large amount of a consumer web service's user base are none technical, "normal", people who will in all likelihood balk at a mor
by simonbarker87 13y ago
The main problem here is that a large amount of a consumer web service's user base are none technical, "normal", people who will in all likelihood balk at a more complicated authentication process unless they can really see the need for it OR it is implemented really well. Currently the best implementation is the card reader used by banks but that is a pain as you have to have it with you all the time (however it is protected people's money and so a certain level of pain is more tolerable in this instance). As a result most banks only use it for big stuff like sending money to a new account etc. I think only Barclay's use it for logon and it is a real PITA and made me leave them as a bank.
Santander use the "if you don't recognise the picture above then don't login" method which is stupid as if people don't login regularly then they will forget what picture they choose and login anyway.
- andyhmltn 13y agoThat's a very good point. Two factor authentication is the way to go IMO. It is a pain to have it with you all of the time, but what if it was just a simple little USB that you used to reset the password? To login you need your password + your phone but to reset your password you need that USB with a unique fingerprint on. That way, I'd just keep it at home in some kind of safe.
- 6d0debc071 13y agoI tried using google's two factor auth for a while. It was such a pain to have to unlock my phone and load the app every time I wanted to log in that I stopped using it pretty quick. When people are used to just loading their password manager up when they start their computer, sticking their more secure details into that, and then being able to log in to wherever with a click and a very short wait, sticking that sort of extra complexity in seems like a deal killer. Maybe for my debit card but... then it's worth going to a little extra effort for the security.
- andyhmltn 13y agoMost accounts remember you've authenticated until you log out. That's never been a problem for me
- 6d0debc071 13y agoIt's cookie based. The system tries to put a cookie on your computer to stop you clearing your cookies at the end of the session. It's not meant to ask you to reauthenticate on every login, if you look at the help, it tells you that clearing the cookies is probably responsible. More bother than its worth to me under those conditions, ought to be Ip based instead and kept server side.