All sounds great until you lose your phone or FIDO device, or it’s stolen, or your facial login is spoofed but still probably pretty great on the whole when combined with other methods.

  • MutatedBass@lemmy.world
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    I am certainly no expert but I think conceptually they are neat so long as there is another way to access the account if, like you say, you lose the device or something else happens. In the current world of social media and AI, facial login would seem to me to be the furthest thing from secure.

    • 🇺🇦 seirim @lemmy.proOPM
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      Agreed, they fall into the “something you have” category which is great because it’s harder for a bad actor to obtain them, like they could obtain 2FA keys in some way, example, nullifying their value. But as long as there is a failsafe backup way like you say I like it.

      • thejoker8814@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        1 year ago

        Biometric authentication methods are in general not very secure. Besides the fact there are a whole lot of procedures to fake/ spoof the biometric data. Once breached - you can not change your biometrics that easy. Keys and passwords can easily be replaced.

        Further, if you use biometric auth for a lot of services you open your self to a single point of attack - that is pretty similar using the same password for many services. And we don’t do that!

  • crdz@lemmy.one
    link
    fedilink
    arrow-up
    2
    ·
    edit-2
    1 year ago

    I think it’s a step in the right direction to get users to adopt MFA. I know too many people that still rely on using the same easy to remember password to login to too many accounts, especially important ones and are too “busy” to set up a password manager or even set up MFA through other methods. Having something built in would be good for them. My only concern is that this is something aimed at newer devices and not too much for legacy devices that may not have a Bluetooth enabled desktop. Of course those are probably now viewed as the not the norm for everyone as now everything is done on newer laptops and phones that have everything built in to use these new technologies.

    I also don’t like having all my eggs in one basket, like relying on Google to protect my backup codes and MFA options while assuming they will use E2EE while transferring my data, which apparently they’ve already dropped the ball on their new feature of backing up information into the cloud by default.

    https://www.bleepingcomputer.com/news/google/google-will-add-end-to-end-encryption-to-google-authenticator/

    Edit: added link to article about Google E2EE problem I mentioned above.

    • 🇺🇦 seirim @lemmy.proOPM
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      Aye thank you for the info on the lacking end to end encryption at Google Authenticator - I didn’t realize that. Big weak point there in the system.