But even companies like GitHub,

[poxoja9630]

which implement a wide variety of 2FA options , still enable SMS 2FA. And importantly, GitHub doesn’t force its users to use SMS, but leaves it as an option for those who might value its benefits over additional protections like TOTP or WebAuthn . Google research also shows that SMS is still an effective form of authentication, helping to “block 100% of automated bots, 96% of mass phishing, and 76% of targeted attacks.” 4. A2F is only useful if users enable it While companies can require employees to enable it, most consumer apps don’t enforce 2FA.

The onboarding process is incredibly important because providing secure authentication philippines whatsapp number channels isn’t enough if no one is using them. SMS-based 2FA is one way to add 2FA to an account with the least friction: in one research study, users were able to set up the factor an average of 2.6 times faster than with an authenticator app. Unfortunately, many users won’t take the time to download an additional authenticator app. This is also why I don’t expect to see WebAuthn usage explode until authentication platforms become widely available. A 2019 study on the ease of use of 2FA found that only 29% of people thought the inconvenience of 2FA was always worth the security tradeoff.



As one participant observed, “I just don’t think I have anything that someone would want to take from me, so I guess that’s why I’m not too worried about it.” To compensate for the time invested, you can encourage A2F like Fortnite did by enabling in-app rewards for gamers. 5. NIST says SMS-based 2FA is OK The National Institute of Standards and Technology (NIST) debated demoting SMS as a 2FA channel in 2016. But after soliciting public opinion, they ultimately decided to keep SMS as their second-factor recommendation. NIST acknowledged that: “Leveraging SMS as a second factor is less effective today than some other approaches—but still more effective than a single factor.