Hacker News Reader

Comment by ridaj | Hacker News Reader

A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities.

A further cost is that they usually require the user to install and set up an app, contrary to SMS.

View on HN

OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient

I wonder how that looks like for bank apps? Banks could (and I’m sure they have) offer their own TOTP client, perhaps a bit more integrated. I’m sure that would be easier and offer a better experience than downing some random. "Google Authenticator" app.

Yes, that works well. My bank has integrated this functionality this functionality into their mobile app, allowing one to use it to login on a computer. When large amounts are to be transferred, the bank-supplied 2FA device is still needed though (which can be annoying, but seems sensible).

This scheme also works really well with payments from your computer. Just use the bank app to scan a qr-code on checkout, verify the payment details on your phone, touch a button, and you're done.

I'd guess that a majority of the bank's clients are using this method. This is in the Netherlands, by the way.

I use Authy for all my accounts and it’s way more convenient than SMS.

Reply on news.ycombinator.com