Comment on Why have so many services started using single-factor passwordless authentication in the last little while?

• lovely_reader@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  I’m not defending passwords specifically. You could do better 2FA with email + biometrics, although of course device authentication is only as secure as the device itself—but that’s entirely beside the point, which is that there must be two factors if you’re going to call something two factor authentication.

  source

  • FreedomAdvocate@lemmy.net.au ⁨3⁩ ⁨weeks⁩ ago

    Passwordless isn’t 2FA……it’s passwordless.

    source

    • lovely_reader@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

      I see that the comment I initially replied to has been edited, but it still reads as though the second factor of 2FA is itself 2FA:

      Because passwordless authentication is awesome and needs to be the standard. It’s basically just skipping the password and going straight to 2FA, which is the main security behind any account that you’ve got 2FA on.

      2FA stands for two-factor authentication. The typical case you’re describing:

      Factor 1: password Factor 2: device check, usually

      That second step of device verification itself isn’t 2FA, it’s only the second factor of that particular 2FA, and the reason your account is more secure behind it isn’t because it’s a device check but because it’s a second factor. There’s not really a “main” security check in 2FA because having two is the whole point.

      I do have thoughts about passwordless as a standalone security measure, but that’s not at all what I’m addressing here. I will add, however, that since passwordless can only ever be as strong as the security on your email account…it might seem like enough if your email is protected by 2FA—but not if you mistakenly leave your email logged in on a device someone else has access to, which may sound stupid but it definitely happens.

      source

      • FreedomAdvocate@lemmy.net.au ⁨2⁩ ⁨weeks⁩ ago

        I see that the comment I initially replied to has been edited, but it still reads as though the second factor of 2FA is itself 2FA:

        Sorry but that’s just you misinterpreting it. I was explaining what passwordless authentication is like compared to the current password+2FA system, in which passwordless is basically just going straight to the 2FA, not that passwordless is 2FA. You don’t need to explain 2FA to me, I very much know what it is lol

        it might seem like enough if your email is protected by 2FA—but not if you mistakenly leave your email logged in on a device someone else has access to, which may sound stupid but it definitely happens.

        This is the worst argument that people keep coming back to. If you have left your email logged in on a device that someone else has access to, you’ve been compromised. You don’t use that as an argument against other services.

        Also passwordless isn’t only authenticated by email. It’s usually done via an authenticator app.

        source
• fox2263@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  Because the password still needs to be correct. What if the thief has your phone but no password

  source

  • FreedomAdvocate@lemmy.net.au ⁨3⁩ ⁨weeks⁩ ago

    If a thief already has your phone unlocked then nothing else matters.

    source

    • fox2263@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

      There’s lots of factors for everything isn’t there. If a thief has your phone unlocked then yes you’re pretty much knackered

      source

      • FreedomAdvocate@lemmy.net.au ⁨2⁩ ⁨weeks⁩ ago

        There’s no other factors when a thief already has your phone unlocked, which is why it’s a bad point to use against passworldess authentication in this argument.

        source
  • NewDark@lemmings.world ⁨3⁩ ⁨weeks⁩ ago

    Password reset?

    source

    • fox2263@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      But they don’t have access to your email in this instance.

      If the thief has your email and password and phone then you’re SOL

      source

      • NewDark@lemmings.world ⁨3⁩ ⁨weeks⁩ ago

        If they don’t have email access, why is a password less magic link bad then?

        source

        • -> View More Comments
      • FreedomAdvocate@lemmy.net.au ⁨3⁩ ⁨weeks⁩ ago

        If they’ve got your phone with your 2FA they’ve also got your email on your phone lol

        source