The 1 thing that’s missing in 2FA

Wikipedia, Twitter, GitHub, Trello, …
Hundreds, if not thousands of websites require multi-factor authentication, or at least offer it as a complementary security measure.

WordPress, Roundcube, Kanboard, Nextcloud, …
Hundreds, if not thousands of web applications offer multi-factor authentication by default or as a module/plugin.

And yet, there is one thing that none of all these 2FA developers/implementors have thought of. And since I don’t have the time, nor the desire, to submit a bug report for each of these thousands of applications and websites, I’m just going to say it here. Kudos to all developers who read this, realize that I’m right, and implement this.

IF AND WHEN SOMEONE REACHES MY 2FA FORM AND CANNOT COMPLETE IT, I WANT TO BE NOTIFIED!

If someone reaches the 2FA form, this means that they have correctly entered my password.
If someone cannot complete the 2FA form, this means that they probably do not have my phone or 2FA device.
So it is very probable that someone who cannot complete the 2FA challenge IS NOT ME.
This means that someone who is not me has managed to correctly enter my password.

This means that very probably my password has been compromised, and I must change it. NOW!

So, if the above is too much text for you, let me summarize below:

IF SOMEONE CANNOT COMPLETE MY 2FA CHALLENGE,
THEY HAVE PROBABLY ALREADY COMPROMISED MY PASSWORD,
AND I NEED TO KNOW ASAP!

And actually, I’d even prefer to know if they reach the 2FA form and don’t try to complete the challenge. Because if I want to log in, I go all the way, and I don’t abandon between password and 2FA.

REPUBLISHING TERMS

You may republish this article online or in print under our Creative Commons license. You may not edit or shorten the text, you must attribute the article to OhReally.nl and you must include the author’s name in your republication.

If you have any questions, please email rob@ohreally.nl

License

Creative Commons License AttributionCreative Commons Attribution
The 1 thing that’s missing in 2FA