this post was submitted on 23 Sep 2023
824 points (98.7% liked)

Programmer Humor

32435 readers
380 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

founded 5 years ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[–] TehPers@beehaw.org 2 points 1 year ago

although it uses your biometric data, it's still a single factor of authentication

Speaking from my experience, I use my phone for biometric authentication. At least from my point of view, I see that as two factors (what I have and what I am) since the biometric authentication only works on my phone.

I am not sure I understood you here. What do you mean by "instead of having each service do their own thing"? Each website using their own method of delivering OTPs?

Basically having multiple places where codes may be generated. This way you can use one location to get OTPs instead of having them delivered via SMS or generated by a different app/service. It ends up being easier and more convenient for the end user (which of course increases adoption).

I guess this has more to do with services adopting OTP generators than sending them via SMS though.

From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.

If logging into the password manager to get the password is sufficiently secure (locked behind MFA), then I don't see the benefit of using a separate OTP generator (aside from maybe if your password manager has a data breach or something, which should be a non-issue except it clearly isn't thanks to LastPass...)

I'm starting to wonder if phones (or other auth-specific devices) should just become dedicated authentication devices and passwords should just be phased out entirely tbh. Passwords have always had issues because their static nature means if someone learns your password without your knowledge, that method of authentication becomes worthless. The main concern would be what happens when you lose your phone I suppose.