[zanny]

Two factor is not a good solution either. Having to lug around your phone pulling up randomly generated strings from an RNG on both ends... defeats the point. Instead of an RNG seed, have a shared secret.

Of course, you need a trusted party for that, but that is how oauth and friends work. And how Persona should have worked. Logging in to anything should be clicking login and everything happening behind the scenes, because you are already trusted and authenticated by a dozen other services that whomever you are trying to access should defer to to identify you.

At least that is what Persona was supposed to do, and then fell flat due to slow adoption. But it was a chicken and egg problem through and through - nobody would use an immature Persona, and Mozilla abandoned it before it had time to shine.

Oauth is the maimed cripple of what should solve all of this, but at least it gets the correct UX to end users most of the time, even it if means wading through a half a dozen login buttons from various services selling your identity.

Considering modern browsers all support synced data stores, why the hell is there not some standards pushing api a la webrtc (in scope and adoption) to get randomly generated unique id keys made browser side for each service you use, that you can then sync between devices and across your browser "account"? Persona was meant to become that, but it died. Where is the successor?

[ayrx]

Uhm... The 2FA used in Google Authenticator does use a shared secret. The algorithm is TOTP (RFC 6238). It's simply a HMAC applied on the current unix timestamp with the shared secret as a key and truncated to 6,7,8 digits depending on the implementation.

[zanny]

My point is that you are taking what should work behind the scenes (common shared secret) and forcing a user interaction (typing or copying out a code) because synchronizing that secret across user accounts on disparate devices is considered "too hard" a problem, even though like I said the browser can be a perfectly good commonality and Persona was on the brink of fantastic innovation on that front.

[icelancer]

>Two factor is not a good solution either. Having to lug around your phone pulling up randomly generated strings from an RNG on both ends... defeats the point. Instead of an RNG seed, have a shared secret.

Google Authenticator has TWICE gotten out of sync with my Authenticator apps, including Google's own accounts and my WordPress installs. I've had to turn it off and just resort to single-factor auth, or using stuff like Mailchimp's own app.

2FA is great in theory but it's failed twice for me and it's been a huge hassle.