Hacker News Reader

Comment by xienze | Hacker News Reader

> certainly much better than SMS. And it’s much easier to implement than SMS as well.

Certainly it is, and where sites have it available I prefer to use it over those stupid SMS codes. But -- having worked closely with marketing/UX teams in the past, I'm fairly certain the hurdle isn't technical, it's that most users can at least sorta understand 2FA in the form of an SMS message, not so much using a dedicated password manager app that keeps track of TOTPs. I like to think this explains why lots of "big" sites that deal with customers from all walks of life (like banks and utilities) offer, at best, SMS 2FA.

View on HN

easier to implement than SMS

Maybe for the IT group. Not for the end-user.

SMS MFA on Apple is so easy it's ridiculous. The OS autofills the MFA form with the received value. There's nothing for the user to do beyond flipping a switch in settings to allow SMS messages to pass through from phone to Mac or iPad.

Versus any other MFA system, which requires manual intervention. Yubikey - either have to read the code and type it manually OR tap the device (if you're on a laptop with an open USB port). App-based - have to open the app and copy/paste or manually enter the code. Etc.

When you use Bitwarden to fill in credentials, it also copies the TOTP code automatically for that account. I find it quite convenient most of the time.

But what is stopping them from offering both? You can have the SMS 2FA as the default option, but also offer TOTP for the technically minded.

Generally the justification is "hey, we offer one form of 2FA, that's pretty good. This TOTP thing is for paranoid nerds." Bosses see it as extra work for ~no gain, what's the point? You can explain the technical superiority of the approach until you're blue in the face but they see it as just another way to do what's already implemented.

The technically minded can simply use a strong password.

This! There is no additional security for aware users with MFA. Make MFA turned on by default, ok, but for god's sake if you provide only SMS-based 2FA, allow it to be disabled.

This. Banks have to cater to customers with all levels of technical abilities for compliance, plus they may rely on older on-prem IAM systems that don't support TOPT.

Vanguard actually supports fido2/webauthn. I registered two keys and they sent me two confirmation letters in the mail, one for each key.

Its not socially acceptable to say in public that you don't know how to text, so SMS 2FA has zero help desk support costs.

It is socially acceptable to say you as a revenue generating customer don't know every little detail of TOTP, so the help desk for all practical purposes has to become a TOTP app help desk and provide support for every app ever written and every use case imaginable including device upgrades, etc. There is no upper limit to technical support. "Your helpdesk told me to install this app and now my battery is dead I demand compensation"

TOTP is pretty expensive to implement.

Reply on news.ycombinator.com