Playing with more user-friendly methods for multi-factor authentication

The problem with multi-factor authentication is its overuse. I would also hate physical keys if every single door I came across required me to unlock it.

When you already have so many logins that you start using a password manager, your passwords are already high entropy enough that they don't get brute forced and a leak doesn't compromise your other accounts. TOTP adds challenge response to this, so it is actually a bit better than a password since an interception cannot be reused, but they are both still shared secret and in both cases need to be stored in some other device (password manager vs TOTP code manager). For most logins that don't require real security I just use my password manager for both so it is just a disjoint shared secret approach. Nevertheless, TOTP "increases security" for websites (but not my security specifically) because the shared secret is generated by the website owner so is definitely unique and not reused unlike many other user's passwords.

I expect the majority of people are storing their TOTP secrets on the device they are logging in from (their mobile device) and so have single points of vulnerability. So multifactor auth is typically just a disjoint shared secret with a partial challenge. The extra security is just created because the website forces true random shared secret. We could have all this with a single factor.

> When I tell people I work on authentication software, I nearly always hear some version of the same story: I hate multifactor authentication. No, really. People hate this stuff.

I hate all of the half-cooked non-TOTP MFA methods that I'm forced to use. Just let me use my freaking authenticator app. If you believe that your users prefer (or maybe it's just you?) more databroker-friendly methods, then fine, but please at least provide TOTP as an option.

Quite funny. Amusingly, the self-portrait method is effectively the signatures we considered acceptable for financial and legal transactions for many decades - make up a scribble and compare it to a scribble you do previously - if it's close enough and you _seem_ to be the guy, we're good.

A fingerprint locked NFC Yubikey seems to be the preferred with all ages at work. Everyone likes it as long as it is once per login to the computer (which basically means we have to use Edge for everything which is fine).

Everyone universally hates passkeys because they never work right.

I know that the article is a joke, but the last one is (or was?) actually used by Facebook as a forced mfa when it suspected a correct login to be "suspicious".

Of course, it's also a way to force users to tag their contact's photos and train Facebook's face detector by holding your account hostage until you comply, similar to those CAPTCHA street view challenges.

Besides, it only works if the attacker is a stranger, if it's an acquaintance (or a very dedicated stalker) then it doesn't work so well anymore.

Poker hands would pretty cool for encoding things that you have to recognize quickly; e.g., key fingerprints. If there are 2.5M unique hands then encoding 256 bits of information requires 12(ish) poker hands.

One aspect I find puzzling is why most two-factor authentication (2FA) applications restrict authentication to only a single valid code at any given time. This constraint inevitably creates a window during which it is inconvenient or impractical to copy the code to another device. Allowing the previous code to remain briefly valid would eliminate this unnecessary delay, enhancing usability without significantly compromising security.

Pedantry warning: I'm not convinced that some of these methods qualify as a second factor of authentication, based on the "something you know, something you have, something you are" model. They're both "something you know", right?

These are such terrible ideas that I expect someone already has one of them on github.

Why do we like entropy in auth factors?