As 2FA is becoming more standard, can't we provide a 2FA entry to be used by two individuals rather than just being provided to computers?
Your answer already exists in almost every "E2EE" app. How many times does a person even access their convo partner's Safety Number/Security Code let alone verify it out of band?
Hardware level attestation isn't even required, and would only marginally increase security. Phones are already heavily locked down. If you're in a position to extract from app data, you're probably in a position to compromise the chat app itself, rendering any attestation pointless.
On the flip side, the most common form of a compromise is going to be untrustworthy apps, because for some reason people still use WhatsApp
There are no end of methods using devices to exchange challenge response sequences, but in practical security we have to deal with real people in real contexts. It's why encryption took 30 years to get traction. Passwords already make sense even to a primary school child.
From TFA:
> It's interesting that, in this new age of high-tech AI identity fraud, this ancient invention—a special word or phrase known to few—can still prove so useful.
There are reasons that passwords remain and probably always will be a superior technology [0], and why adding more layers of "solutions" like biometrics and multi-factors actually just increases the attack surface.
Haven't read the FBI guidance yet, but it seems they're suggesting we start teaching this outside of professional scope, to everyone.
I think that's a jolly good idea and will be thinking of how to build it into civic cybersecurity syllabus.
Duress signals and a challenge-response for identification are different beasts, but if we're going to teach people verbal signalling to thwart generative scams then may as well teach the whole gamut of craft.
I mean literally, we both open our phones, what is the number that is linking the 2FA between our two devices. Voice authentication of a rotating password.