top | item 16521920

(no title)

babalulu | 8 years ago

The problem with moving away from SMS authentication is that not everyone in the world has a smartphone or is able to use something like a Yubikey. SMS is the lowest common denominator that allows most people in the world to use 2FA. If you require 2FA and don't allow SMS, you cut off access for a lot people, including the poor and likely the elderly.

discuss

Merad|8 years ago

Hell, there are still plenty of people who don't have and aren't interested in SMS, even if they have a cell phone.

C4K3|8 years ago

SMS doesn't have to be the lowest common denominator, it's not a binary option between SMS or everybody having U2F devices.

In Denmark there's something called NemID [1], which is basically just a credit-card sized piece of plastic with a bunch of 6-digit one-time passwords on it. It's very accessible, maybe not as secure as U2F, but definitely more secure than SMS.

It ought to be possible for the tech community at large to come up with solutions like this that are better than SMS, but still accessible, just as the push-to-approve 2FA mentioned in the OP.

[1] https://en.wikipedia.org/wiki/NemID

fulafel|8 years ago

One time password lists on paper are a time honored way of doing low tech 2FA, and has been widely used by banks since the 90's. It works really well.

JeanMarcS|8 years ago

I was going to say something like that.

If official websites (tax, banks, etc...) start to use app 2FA, people with only a mobile phone will have to use, what, physical mail ? Or will they have to go to buildings in person ?

I agree that the more secure the better, but we mustn’t stop thinking of a big part of population that can not afford smartphones (or key or whatever). Same problem for non technical persons.

Spivak|8 years ago

Why worry about people affording it? TOTP hardware keys are super cheap, just give them out to people without phones at the local BMV. There are some that are credit card sized and one battery lasts 5+ years.

Alternatively there are a number of desktop based 2FA clients:

- Authy - GAuth - JAuth - WinAuth

iak8god|8 years ago

I'd be happy if such sites would just support more serious options than SMS, without necessarily requiring it.

matt_wulfeck|8 years ago

I completely agree. Rather than dropping 2FA-over-sms, we should ask how we can make these systems more reselient to attacks.