Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications.
We desperately need to have better MFA options if we're going to require it from users.
We desperately need to have better MFA options if we're going to require it from users.
Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation).
“MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.
Where I work a bunch of people had a cow about having to put a MFA app on their phones, but refused to take a work phone. Our remedy was to issue them PINs to allow after hours access to the building.