Hacker News Reader

Comment by cxr | Hacker News Reader

Two-factor authentication is the "Are you sure you want to X?" pattern applied to logins. While the world has been moving away from that interaction pattern elsewhere, it was simultaneously introducing it in a high-friction way somewhere new.

The takeaway from the attempts to eradicate "Are you sure[...]?" has been to just do the thing the user said to do, but make it easy to undo rather than double checking. It would be interesting to see how that philosophy could be applied as an alternative to 2FA.

EDIT: Boy, the replies that this comment spawned sure say something about HN. I count one (muxl's) that has any sense of self-awareness. Do you really believe that I don't understand the "purpose of 2FA"? Come on. Be more charitable.

https://news.ycombinator.com/newsguidelines.html

EDIT2: It's a little weird that folks who start out with the goal of being intellectually lazy are willing to put so much effort into it.

View on HN

2FA isn't double checking to make sure you meant to log in. It's verifying that you are the person logging in. Alert fatigue is a real issue as you point out and we need to make sure to not overwhelm users which is one major benefit of federated authentication.

The problem with taking an "undo" philosophy here is that it's very hard (impossible?) to undo the transfer of information which is what attackers are after in many breaches.

It's one thing if I accidentally delete a file without a warning, but can easily undo it.

But if someone logs in to access my files without authorisation... they've got them now. I can't click undo on them having read my private emails, or whatever the 2FA/other security was protecting.

Right, how does GP suggest we undo the act of giving out information? Deploy an ICBM to the geolocated IP that we just accidentally handed out private information to?

> Do you really believe that I don't understand the "purpose of 2FA"? Come on.

Yes. Nothing you wrote leads me to believe you do understand the purpose of 2fa. You can complain all you like, but to me, and apparently others, it seems that you don't from what you wrote. If what you write is misleading to so many people then perhaps rather than complaining about people mis-interpreting what you wrote you might re-visit the thing you wrote.

A: The colour black is white.

B: That's ridiculous.

A: I entirely understand the difference between the colour black and white, "Be more charitable".

Perhaps, but you're missing the entire purpose of 2FA: the "Are you sure you want to X?" is out of band by definition. The first factor is the things you know: username and password. The second factor is something you have.

If a specific 2FA implementation is not out-of-band, that would make it useless as a 2FA and it would be as you describe.

That's a novel way to look at 2FA/MFA, I like it.

I can't think of a way to "undo" in this scenario without some settlement pattern. You can do whatever you want, but it doesn't "commit" until some settlement clears. In this case, still leading back to some kind of "Are you sure[...]" question, except to review in batch, like someone reviewing a bank statement.

Some people like reviewing in batch, some progressively, depending upon their individual perception of the cognitive load involved for them.

Tough to economically prevent spoofing though, when you start dropping aspects of authentication, integrity and non-repudiation. I suspect we can't substantially move that "Are you sure[...]" question's boundary until wearables become implants like a neural lace-grade implant.

(Congratulations on having been the only respondent here to actually have said anything worthwhile. Too late to be able to edit in another addendum to my comment, though.)

Wait, are you arguing that 2FA is a waste of time/not actually effective? What alternative do you propose then to provide additional security to accounts?

Or are you arguing purely in the sense of SMS and Email based 2FA?

Perhaps rather than complaining that people are unable to see the rather inscrutable analogy that you made, you could help them understand it?

The entire industry has moved from a presumption of competency to a presumption of profound, remarkable incompetency.

So insightful things get interpreted as incompetent ramblings. So we're left with virtue signaling. It's a terrible culture.

Reply on news.ycombinator.com