Hacker News Reader

Comment by koito17 | Hacker News Reader

Multi-factor authentication doesn't need a cellular phone. I personally use TOTP codes and security keys whenever I can, as I am very weary of giving away my phone number (I want to believe this is why I rarely get spam calls or texts). There is an obvious downside to security keys (cannot be backed up or transfer secrets), but passkeys are slowly becoming a viable alternative, which gives you almost the same level of security as security keys implementing FIDO2. Major services like GitHub already allow passkey authentication. Both iOS and Android have supported passkeys for a while now, and so have all of the major browsers (Chrome, Firefox, Safari).

So overall, I think passkeys are a good alternative to SMS :)

View on HN

Now try to explain that to a person in their 70s that are thrice removed from tech industry while they're trying to check their bank account balance.

I agree with you 100%, I wish we went for much secure way. Unfortunately UX friction and pre-established ideas will make it way harder to roll out to the general public.

I think 2fa card readers that use your bank card (like the one that goes in an ATM) to generate a code are easier to understand than receiving an SMS. Especially here in chip-and-pin land.

Couldn't the same thing have been said for SMS 2FA, and not all that long ago?

Honestly "plug the little black thing in here, rub the gold dot when the screen says" is better ux than typing numbers. Have you ever the heard stories where people aren't able to type in their code before it expires?

Before a very small amount of years ago, we couldn't check our bank account balances by logging onto the internets. We called or visited a bank teller in person. gasp!

If a person can't handle 2fa, do they really need to be using online services that are important enough to warrant using 2fa? I imagine the world will advance and this will become easier over time, but for now single player security across wires is complicated.

In the past I've been given little key fobs with my debit card that give you a 2FA code when you press a button

The EU requires banks to use secure authentication methods and has done so by a directive more than a decade now. This includes one-time passwords and app based two-factor.

I do not see how the eldery in the US would need more explanations than in the EU.

Reply on news.ycombinator.com