Either make me create a password and then let me into my account or let me use my phone number/email to verify. It’s becoming too much to get into every day stuff. If I have biometrics on there is zero reason for anything else.
Basically the current security system is overdoing it. I suggest getting rid of passwords all together OR only requiring one or the other. Like it I forget my password or I forget my phone I can use the other but JFC its a hassle.
I look at it more like, if you are going to require MFA, why require passwords as part of login?
Multi Factor Authentication (MFA) : using multiple authentication factors to validate a user is who they say they are and grant access
Auth factors:
Something you know: is in your head. Password, PIN, etc
Something you have: credit card, hardware token (yubikey, mag stripe, etc), software token (auth, MS authenticator, etc)
Something you are: biometrics.
Somewhere you are: location based (IP, geo location, geo fence, etc)
Any one method is vulnerable to compromise. By using two separate FACTORS (aka MFA) you vastly reduce risk that you will be compromised.
Using a password and PIN is NOT MFA because they’re both the same auth factor.
Using just a token is NOT MFA because it’s only one auth factor.
I get that only using a token isn’t MFA. I’m just questioning why MFA is a thing if the major issue is really bad password security.
Bad password security is a human problem (can be back end bad practices also, but mostly human) whereas only using one auth factor is a security design problem. Again, MFA bad, single auth not good (but sometimes sufficient)
Also many people aren’t comfortable with auth apps yet and way less are comfortable with hardware tokens.
Passwords, while often implemented poorly by humans, aren’t something you can easily LOSE like your phone or a set of keys.
Many logins don’t really need very good security, like who cares if my lemmy login gets compromised I don’t want MFA here. Some might, I don’t. I still use a password manager but still, just a password is fine.
I dropped a credit union because they don’t allow MFA for online banking at ALL however, which is outrageous in 2025.
Because that’s an authentication factor?
Yes, but there are a lot of people arguing here about how bad passwords are because they get leaked and you need so many of them that it is a struggle for people to remember them. So, if passwords are so bad, why should they be maintained as a method of authentication?
They’re not really that bad, lots of people are just bad at using them. A lot of breaches happen because someone gets lazy and uses a default or something stupidly simple like what you’d use on your luggage.
Yeah, but people have several dozen accounts, passwords have to change on some of them, and it used to be very discouraged to write passwords down so people needed to remember them.
A system has created where there are massive failures in its use because it was poorly implemented.
Then you need to know 2 different codes.
They would need to hack the server password database or your password app AND have physical access to your device.
It is the same concept as using biometric + TOTP or password.
Something you have, something you know, something you are: those are the 3 general “factors”