Hacker News Reader

The ideal solution is passwordless multi factor authentication. You have to the power of randomly generated numbers coupled with extreme usabilty. We do that by scanning an encrypted barcode to login with mfa running in the background. We also can do that with a push login approval, or webauthn or FIDO U2F physical keys.

Disclaimer: worked on the design of the passwordless mfa solution set at saas pass.

View on HN

How are those multi factor? Aren't they all just the single factor of "something you have" if they're passwordless?

You still the need the “what you are” or “what you know” to unlock the mobile token. In addition you can also ask for more as step up additional authentication matters under access control policies.

Can you describe the meaning of passwordless multi factor? What replaces the "something you know" in this case?

you can see it in action at the website of saas pass. You still need a “what you know” or “what you are” to unlock the mobile token.

Reply on news.ycombinator.com