The Psychology of Multi-Factor Authentication
summary
Passwords are brittle: complexity rules and forced rotation drive reuse and credential stuffing that succeed against real services daily. Time-based codes (TOTP) stop some attacks but automated phishing and token desync still let attackers log in. Cryptographic device auth (WebAuthn/U2F) derives a site-specific key, requires a physical touch, and prevents phishing because a forged domain produces a different key. Practical hurdles are legacy protocols (LDAP, Kerberos), UX friction, and recovery flows; adopt password managers and libraries like zxcvbn and prefer device-bound keys where possible.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:18Who Am I
- 4:03Visibility
- 4:34Affordance
- 4:53Consistency
- 5:52Feedback
- 8:03Keyboard Shortcuts
- 9:51Authentication
- 11:11Tech Debt
- 13:26Phishing
- 15:34Credential Stuffing
- 16:07Summary
- 19:17Legacy Systems
- 23:12U2f
- 26:48Future Keys
- 32:16The Truth about Unix
- 41:31Phishing Attacks
- 41:44Principle of Consistency in the Ui
- 44:02Javascript Elements
related talks
32mPasswords are so 1990
51mThe state of passwordless auth on the web
42mChallenges in User Authentication: Balancing Security & User Experience
55mYou Shall Not Password: Modern Authentication for Web Apps
51mYou Shall Not Password: Modern Authentication for Web Apps
17mImplementing Multi-factor Authentication
19mAdvanced Authentication Framework
30mThe State of Passwordless Auth on the Web