4 ms·
For Facebook or Hacker News: Yes, most users want to avoid the need for a physical artefact to log in. For a bank website: No, most users are happy to require
by MarkMc 13y ago
For Facebook or Hacker News: Yes, most users want to avoid the need for a physical artefact to log in.
For a bank website: No, most users are happy to require a physical artefact because they recognise that it helps protect their money. If your phone dies then you are simply be unable to access your bank account until you recharge it.
- vec 13y agoExactly. Good two-factor authentication is not hard. World of Warcraft, for example, has had an excellent real-world implementation for years now. It's actually sufficiently not hard that I'm not sure there's really room for much innovation in that space (unless you count banks actually using it to be innovation). What I'm saying is we need a better solution for Facebook and HN. There's some large subset of sites for which users will not tolerate a physical artifact or convoluted multi-step process. Within those constraints, and with the understanding that we'll never be able to do as well as 256-bit private keys or two-factor, I'm wondering if we can't still do significantly better than alphanumeric passwords.