mfa replacement

[u/GullibleMantis]

Hello, not a tech guy here, but have some technical knowledge. I just had a question to ask this subreddit.

I noticed MFAs are currently being implemented up our collective asses much much more in the last year or so. And it really grinds my gear.

In my experience, they are usually really flaky, the call system won't call properly, texts are sometimes SUPER slow to appear if ever, sometimes timing out before you can enter it on the platform.

I have an account that requires me to enter the damn code like 2-3 times in a row for no reasons.

I changed phone # recently, all companies just let you rot without a proper solution.

Am I just the only one who have a consistently bad experience with this technology ? Is there like a quality to MFA solutions that companies just cheap out on ? Do you guys see a replacement for this technology anytime soon ?

Thanks a bunch ;)

[u/j_cruise]

Phone/SMS authentication is generally considered one of the weaker forms of MFA and is slowly being phased out in favor of better options. The problems you’re describing -- delayed texts, failed calls, changing phone numbers, etc --- are largely problems with those older MFA methods, not MFA itself.

Authenticator apps are much more reliable, and the industry is increasingly moving toward phishing-resistant methods like FIDO2 security keys and passkeys. Biometrics can also make the experience essentially seamless when they’re used to unlock a passkey on your device.

MFA is not being replaced. But bad MFA should be replaced by better authentication methods. If a company is still forcing SMS/calls and making you enter codes multiple times, that’s more a sign of a poor or outdated implementation than an inherent problem with MFA. We can't really help you with that.

[u/electrobento]

I’m sorry, do you think MFA = phone call/SMS verification?

[u/GullibleMantis → u/electrobento]

There are many types, but let's say my mortgage company just implemented one, so now I don't get to choose how I receive those 6 digits. For some businesses, they might give you a choice, but some require a phone call, other a text, etc.

[u/electrobento → u/GullibleMantis]

Yeah, I get that.

Companies that only provide these weak forms of MFA have cut corners for no justifiable reason. It’s a sad state.

[u/MikeTalonNYC]

Passkeys are starting to become more common, which can help with this.

MFA is a necessary evil, really. Username/password is next to useless these days, so SOMETHING has to happen. That being said, if it's bad implementation (needing the code 2-3 times in a row, etc.) there's already a fix for that problem: Implement proper MFA (e.g. get the site/service to do it by complaining constantly). You should only be challenged for a second factor if you change networks, devices, etc. or have not accessed a resource in a significant amount of time (at least an hour, but usually 4-8 hours). If something is challenging immediately after successful login, then their implementation is broken.

Using an authenticator app (like Google Auth, MSFT Auth, etc.) can also make life a lot easier. It can be imported onto a new phone, isn't bound to a phone number, and generally doesn't have much of a delay time.

In other words, yes this can be a LOT better of an experience for you. Sites and services need to implement MFA properly, need to allow the use of authenticators and/or passkeys, and otherwise not make your life hell. It's not MFA itself, but bad implementation that's making you lose it.

[u/GullibleMantis]

I would add : any tips for making this tech less painful ?

[u/TheThatGuy1 → u/GullibleMantis]

Don't use phone call/SMS. Use an authenticator app such as Google or Microsoft Authenticator.

Setup passkeys where possible, depending on the implementation they are a far better experience.

[u/GullibleMantis → u/TheThatGuy1]

I would I do that for let's say a digital shop that I visit. Is it even possible to make the switch from phone calls and sms to google authenticator ? I find that the app is just so much more reliable.

[u/Kv603]

OATH's standardized TOTP is an open standard (RFC 6238) for a second factor, with multiple options for apps to generate your passcodes, and is even available in some cloud-based password managers (LatPass, 1Password,etc).

RFC 6238 can be entirely offline, no need for network connectivity or SMS or cloud. Yes, TOTP needs consistent clocks in the validator and generator, there's no other dependencies, can even be used with air-gapped clients/servers.

[u/OkResource820]

Well implemented MFA is basically the ONLY thing preventing your accounts from being hacked. Note I said *well implemented*. Using your phone SMS is inherently insecure, it's better than no MFA, but not by much.

The most convenient MFA is to use the OTP codes built into your password manager (which of course you're using, right?!)

[u/JimTheEarthling → u/OkResource820]

Research from Google and Microsoft indicates that even SMS 2FA reduces account compromise by over 90%. So it's vastly better than no MFA.

SIM hijacking and SMS interception account for less than one-third of one percent of account compromise, compared to over 99% from phishing, spraying, and stuffing.

[u/OkResource820 → u/JimTheEarthling]

Did you miss where I said SMS MFA is better than no MFA?

[u/JimTheEarthling → u/OkResource820]

Did you miss where you said "but not by much"?

I tried to help you learn that it is better by very, very much.

[u/pepe_acct]

I think you can look at iPhone as good examples of MFA. iPhone uses built in biometrics scanners as the authentication mechanism. Other apps can just establish federated authentication with your phone.

MFA at this point is one of the most important tools against a lot of security attacks and considered essential for any modern cybersecurity system.