Why I‘m using my three or four U2F keys rarely: almost nobody supports them.
Yeah, Google, GitHub, Facebook.
But my bank doesn‘t. My insurance companies don‘t. My broker doesn‘t. It‘s all very sad.
Yeah, Google, GitHub, Facebook.
But my bank doesn‘t. My insurance companies don‘t. My broker doesn‘t. It‘s all very sad.
Disappointingly, my (former) bank, insurance, and broker companies only supported "2"FA via SMS, which is even worse--in my opinion--than not supporting anything at all because it gives a false sense of security. My bank and my mobile phone provider would both allow me to completely reset my credentials using solely a verification via SMS, so anyone who hijacked my phone number could steal from me.
Even more obnoxiously, lots of businesses don't accept "VoIP" SMS numbers because they are deemed "insecure," even though my VoIP numbers are hardened behind much better account security than anything my mobile provider offers.
Admittedly, the chat bot is a hobby project so I was only looking for a couple of weeks in my spare time, maybe I “looked wrong” but everything I found was focusing on clients and rarely on servers.
You do need to go into this either understanding what's actually going on or open to just being told what to do rather than trying to plug it into a model you have from, say, using password authentication.
Your code (typically JavaScript) running on the client is going to feed input from your server (getting it to the client is your problem, inline it in the HTML, read it from a WebSocket, whatever) into this API and get back a result. The result needs to go to server - again how you do this is up to you. The server verifies stuff, I guess that could be handled in a library or something, and then you've authenticated the user, done, set a session cookie or whatever.
EDIT: apparently the OP meant SMS password reset without requiring the second factor, not SMS 2FA. Of course that's terrible.
It's more like you have a deadbolt and a regular lock. Sure, you can open the regular lock with just a credit card, but that doesn't help you with the deadbolt...
If I want to compromise your account, I force fallback and then compromise your SMS. Security is as strong as the weakest link.
Sure - Google, Github, Fastmail. But nothing financial. Not even the more startupy stuff like TransferWise and Revolut. Fastmail forced me to enable SMS 2FA to use U2F, which I suspect is actually worse than not using 2FA.
Also, a inherent problem: I would really like to keep a backup key in a galaxy far, far away in case my house catches fire, but I cannot enable a key if I do not have it at hand.
This was years ago, so YMMV.
It's a real UX issue, the average person just can't back up their TOTP codes at all. Hell, I have a Yubikey as a backup and enroll the TOTP code to both places, and to the Yubikey as U2F.