Good points.
I'm struggling to come up with a better second factor for "normal people".
* Email: good if it is different than your login identifier and not tied to something ephemeral like work or school. But how many folks have two email accounts they regularly check.
* Passkeys: tied to a single device, so you need multiple devices. Or you can trust a bigco to sync private keys (!) across devices.
* Social sign-on: has the issues you point out, primarily that it is a single point of failure and the company providing the service doesn't do customer support (typically).
* Paper mail: latency is too high.
* Phone call: subject to same SIM card issues as SMS.
* Questions about identity, such as mother's maiden name: hard to find ones that are secure/private but can be accessed at scale only by "good" actors.
TOTP: hard to get normal folks to adopt.
What am I missing? Am I reluctantly forced to conclude that SMS is better than, or at least on par with, the alternatives?
I'm struggling to come up with a better second factor for "normal people".
* Email: good if it is different than your login identifier and not tied to something ephemeral like work or school. But how many folks have two email accounts they regularly check.
* Passkeys: tied to a single device, so you need multiple devices. Or you can trust a bigco to sync private keys (!) across devices.
* Social sign-on: has the issues you point out, primarily that it is a single point of failure and the company providing the service doesn't do customer support (typically).
* Paper mail: latency is too high.
* Phone call: subject to same SIM card issues as SMS.
* Questions about identity, such as mother's maiden name: hard to find ones that are secure/private but can be accessed at scale only by "good" actors.
TOTP: hard to get normal folks to adopt.
What am I missing? Am I reluctantly forced to conclude that SMS is better than, or at least on par with, the alternatives?