A tale of two sides of 2FA
summary
SMS is unreliable as a second factor: NIST deprecates it since 2016, carriers are vulnerable to SIM swap and SS7 interception, and Google finds only about 9.7–10% user adoption even after extensive UX work. Safer options discussed include TOTP apps (Authy, Google Authenticator, Microsoft Authenticator), push, email OTP caveats, and hardware tokens (YubiKey, Google Titan). Concrete developer actions: require long passphrases, use adaptive one‑way hashing, implement rate limiting with exponential back-off, provide recovery codes, and mandate hardware 2FA for admin accounts.
AI-written summary · about
chapters (48)
- 0:00Introduction
- 0:33Learning Objectives
- 2:28Login Screen
- 2:58Social Engineering
- 4:56Reddit Hack
- 5:21What is Authentication
- 5:44What are the different factors
- 6:51What happened
- 8:22SMS 2FA
- 9:04Signaling System 2
- 9:43Hacking Options
- 11:00TimeBased OneTime Password
- 12:20Push Notifications
- 13:17Email
- 14:06Tokenbased
- 15:17OTP vs U2F
- 16:35What would we change
- 19:06Whats up now
- 19:23Security
- 19:55Ring Nest
- 20:10IoT Cameras
- 20:42Security Basics
- 22:38Xkcd
- 22:57Why does this help
- 23:55Password calculator
- 24:35Password policies
- 25:20LinkedIn
- 25:48Pandora
- 25:58Password hash encryption
- 27:16Adaptive oneway functions
- 27:52Verification codes
- 28:44Lessons learned
- 29:20Twofactor authentication vendors
- 29:50Rate limiting
- 30:36Truncated exponential backoff
- 31:08Im a Ruby programmer
- 32:42User optin
- 33:40American Express shame on you
- 34:06Do it yourself approach
- 35:02User testing
- 35:40User errors
- 36:35Friction
- 37:26User Experience
- 38:24Thanks
- 38:36Flywheel
- 38:46Remote Happiness
- 39:32User Experience Design
- 41:21Reset Passwords
