2FA in 2020 & Beyond
summary
Shows concrete trade-offs: SMS is easiest to onboard but vulnerable to SS7 and SIM swap; a Google study reports SMS blocks 100% of automated bots, 96% of bulk phishing, 76% of targeted attacks. TOTP (Authy/Google Authenticator) uses a shared secret and clock so TOTP works offline but needs an app. Push auth is asymmetric and fast but users may accidentally approve. WebAuthn/U2F gives strongest crypto; enterprise use with YubiKeys succeeds unevenly — U2F setup success 83% vs 32% — and device costs and onboarding still limit adoption. Adoption has roughly doubled; incentives (Fortnite spike) and measuring ATO cost, compromised accounts, and support tickets determine what to deploy.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:36Cost of account takeover (ATO)
- 3:42SMS one-time passwords
- 5:08TOTP
- 6:36Push Authentication
- 8:21U2F / WebAuthn
- 9:36Factor usability
- 13:262FA adoption
- 15:20Measuring success
