Hacker News new | ask | show | jobs
by masterofmisc 1942 days ago
I don't know about the US but Barclays in the UK has had multi-factor authentication for years now. Is that not the case in the US?
2 comments

If it is TOTP/HOTP based rather than U2F (6-digit codes), it is vulnerable to real-time spoofing.
U2F is a specific type of 2FA/MFA.

They are not congruent.

U2F is (as its full name "Universal Second Factor" would suggest) specifically only a second factor, it doesn't make sense as your first or only factor.

WebAuthn can replace the entire authentication, because it can perform multi-factor authentication locally and then send a claim to have done so, optionally backed by attestation from a vendor saying they promise the multi-factor authentication is done by their product. For example an iPhone can have one press sign-in to web sites or apps using this technology.