zlacker

And then people are surprised that users stick with passwords.

IMHO that and a TOTP seems to be a sweet spot.

>>userbi+(OP)
Yep.

2 factor authentication using 2 simple mechanisms is great.

Password for most cases. And then in high value things, ask me for 2FA. For things like banks and anything money related, SMS 2FA already exists and is good enough. For normal websites, uncommon yet important actions, such as logging in (everyone can use long lived sessions these days), repo deletion on GitHub, etc, ask for me for 2FA.

TOTP is also a really nice mechanism, especially in authenticator apps today that can backup your keys to cloud storage.

I know "SMS" and "backup keys to cloud storage" gets the security folks off their chairs, but outside a theoretical setting they're both a perfectly good tradeoff.

>>userbi+(OP)
Except that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.

>>userbi+(OP)
To me, they're an annoying half-measure: Not phishing/MITM resistant, yet annoying to use in practice.

I'll still take them over SMS-OTP any day, but admittedly even that at least offers some technical benefits over TOTP, e.g. in that the relying party can tell me what I am consenting to in the message ("by entering this code, you approve a payment of $1000 to evilshop.com").