At this point, 2FA is the only thing I use my phone for anymore. It's the only r...

waterproof · 2024-10-23T19:46:29 1729712789

It wouldn’t be too hard to create a physical device that can only be used to set up and retrieve Authenticator-app style 2FA codes.

All you’d need is a camera to read QR codes, a display, a few kB of storage and some pretty basic processing.

But then I guess that storage would need to be encrypted with some sort of authentication. Hmm.

lxgr · 2024-10-23T23:24:51 1729725891

What about extending the protocol to an actual channel-bound challenge-response one, without the need for a (risky) out-of-band key exchange via a QR code?

We could call it something like Web Authentication. I could even imagine small, keychain-sized USB authenticators that you have to touch a capacitive button on to approve an authentication :)

yencabulator · 2024-10-24T22:19:23 1729808363

That doesn't help when the services insist on SMS as 2FA.

mixmastamyk · 2024-10-24T16:09:41 1729786181

Yubikey, FIDO2, etc already exists, though not supported everywhere.

fsflover · 2024-10-23T21:37:10 1729719430

Sounds a bit like Precursor.

mixmastamyk · 2024-10-24T16:07:57 1729786077

Most systems that have 2FA have MFA, TOTP or FIDO2 key. That’s what I use. Never SMS as it is unsafe.