I'm curious; why aren't we dropping the use of passwords in favor of U2F?
I guess for one; not everyone wants to buy and carry a key. But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden.
I guess for one; not everyone wants to buy and carry a key. But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden.
Well, you are favoring U2F, which is a _specific_ _implementation_ of 2FA. U2F isn't being used generally, because it isn't a general purpose solution.
> I guess for one; not everyone wants to buy and carry a key.
This statement is the problem with looking at specific implementations to solve a general problem, instead of looking at all the solutions.
There are many solutions, not all of which even use physical keys fobs. RSA is a straightforward example of why a 3rd party shouldn't automatically be trusted for auth mechanisms.
> But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden.
The burden isn't just a user side issue about carrying a fob. For general password replacement, key fobs will get lost. Passwords are a burden to the user, having to pay or deal with key fobs and their replacements will be an even greater burden. You are proposing to solve the auth problem by causing many users to stop using websites.
Unfortunately, there are also issues with soft tokens. There are still applications that only use the "first soft token" in a list of soft tokens owned by a user. Plus, soft tokens are quite amenable to being copied.
There are also many banks and credit card issuers who have consciously chosen various forms of 1.5FA instead of 2FA. In many cases this is a valid solution, a form of dual sided auth that works across all clients.
Security-conscious users can push for 2FA on services, but we probably won't hit it being mandatory any time soon.
1. Your profits come directly from your users
2. A password crack can result in them losing a significant amount of money, and
3. This happens often enough that it offsets the userbase losses of 2FA
If your user accounts are important enough to let them lose a large amount of money, your users are probably demanding better security from you already. The real blocker to 2FA are services which rely on being convenient, and make money off their users being users e.g. social media.