3 ms·

Any method of authentication that's more secure that simple passwords is going to be more inconvenient. 2FA is no exception.

freehunter 12y ago
It doesn't have to be though. Clef is 100x easier than using a password, and dead simple to implement. Nothing to remember but your phone, and nothing to change at regular intervals. Google Authenticator is a little more inconvenient, but not by much. Of course, as my first comment pointed out, both of those became very inconvenient for me. But they don't have to be. What if Clef, instead of being proprietary, was a public property? Anyone can write a Google Authenticator application, which is why one exists on Windows Phone. Google has written zero software for Windows Phone, yet Authenticator works. 2FA doesn't have to be more inconvenient. In fact, it should be more convenient than passwords, because passwords need to be remembered and changed. There's no excuse.
- dragonwriter 12y ago
  > 2FA doesn't have to be more inconvenient. In fact, it should be more convenient than passwords, because passwords need to be remembered and changed. The second factor (the "thing you have") in 2FA doesn't need to be remembered or changed. The first factor (the "thing you know"), which usually is a password, has to be remembered. (It may be somewhat less important to change it than in a single-factor password-only scheme.)
  - freehunter 12y ago
    With a good 2FA system, you can use a junk password because the chances of someone having both factors is next to zero. Using hunter2 as a password instead of gEtRAn8s_dr6Spepe doesn't matter because guessing the password is impossible unless they have your other factor, and even then it's going to slow them down quite a bit. Especially if your other factor is stored on your phone, which itself requires a password or fingerprint or both to get into.
    - dragonwriter 12y ago
      > With a good 2FA system, you can use a junk password because the chances of someone having both factors is next to zero. If you use a junk password, then the chance of them being able to secure both factors is essentially equal to the chance of them being able to secure the other factor. Whether slowing them down matters really depends on context -- for most applications that may be an acceptable risk (if either the value of the access goes down with a delay or you will be able to report the loss in a way which prevents a slowed attacker from gaining access -- and its unlikely that an attacker will be motivated enough to prevent you from doing so -- this makes sense. This is not always the case.)
      - freehunter 12y ago
        You make good points. What I'm really trying to say is, someone sitting in Russia can't really take my phone while I'm here in the US. That's not the case with passwords. And it's not plausible to think there's someone who can both steal my phone and has access to my password for a given account, unless that person knows me. The only hope they have is using a rainbow table or dictionary attack. With most sites these days rate-limiting the login process, that's hardly plausible either. What I'm saying is, even basic 2FA makes it almost impossible for someone to steal your credentials in the fashion that we are used to. It doesn't just put us on par with the criminals like most security does, it puts us one step ahead for the first time in over a decade. And it can be easy and convenient, because you don't need billion-character passwords since the attacker needs to be physically near you to steal your second factor. There are easy ways to make it better, just no one has done it yet (because there's no money in it).

freehunter 12y ago

It doesn't have to be though. Clef is 100x easier than using a password, and dead simple to implement. Nothing to remember but your phone, and nothing to change at regular intervals. Google Authenticator is a little more inconvenient, but not by much. Of course, as my first comment pointed out, both of those became very inconvenient for me. But they don't have to be. What if Clef, instead of being proprietary, was a public property? Anyone can write a Google Authenticator application, which is why one exists on Windows Phone. Google has written zero software for Windows Phone, yet Authenticator works. 2FA doesn't have to be more inconvenient. In fact, it should be more convenient than passwords, because passwords need to be remembered and changed. There's no excuse.

dragonwriter 12y ago
> 2FA doesn't have to be more inconvenient. In fact, it should be more convenient than passwords, because passwords need to be remembered and changed. The second factor (the "thing you have") in 2FA doesn't need to be remembered or changed. The first factor (the "thing you know"), which usually is a password, has to be remembered. (It may be somewhat less important to change it than in a single-factor password-only scheme.)
- freehunter 12y ago
  With a good 2FA system, you can use a junk password because the chances of someone having both factors is next to zero. Using hunter2 as a password instead of gEtRAn8s_dr6Spepe doesn't matter because guessing the password is impossible unless they have your other factor, and even then it's going to slow them down quite a bit. Especially if your other factor is stored on your phone, which itself requires a password or fingerprint or both to get into.
  - dragonwriter 12y ago
    > With a good 2FA system, you can use a junk password because the chances of someone having both factors is next to zero. If you use a junk password, then the chance of them being able to secure both factors is essentially equal to the chance of them being able to secure the other factor. Whether slowing them down matters really depends on context -- for most applications that may be an acceptable risk (if either the value of the access goes down with a delay or you will be able to report the loss in a way which prevents a slowed attacker from gaining access -- and its unlikely that an attacker will be motivated enough to prevent you from doing so -- this makes sense. This is not always the case.)
    - freehunter 12y ago
      You make good points. What I'm really trying to say is, someone sitting in Russia can't really take my phone while I'm here in the US. That's not the case with passwords. And it's not plausible to think there's someone who can both steal my phone and has access to my password for a given account, unless that person knows me. The only hope they have is using a rainbow table or dictionary attack. With most sites these days rate-limiting the login process, that's hardly plausible either. What I'm saying is, even basic 2FA makes it almost impossible for someone to steal your credentials in the fashion that we are used to. It doesn't just put us on par with the criminals like most security does, it puts us one step ahead for the first time in over a decade. And it can be easy and convenient, because you don't need billion-character passwords since the attacker needs to be physically near you to steal your second factor. There are easy ways to make it better, just no one has done it yet (because there's no money in it).