2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec. Sometimes a lot longer (some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time, and then you have the time it takes to find your phone, unlock, decline twice the iOS update prompt, go to the right app, find the right msg, copy the code, check it is correct, etc etc).
Yeah if it is really a critical service and rarely used, we should. But if I have to wait 30sec in front of a login box every time I go on netfix or on amazon, you can bet their sales will go down the drain.
> some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time
SMS isn't real time either, it's best effort. Mostly (~99,9%) it gets through within seconds, but delays of a few minutes are perfectly acceptable to telcos. As service provider you can't do much about it, either pay through the nose for "priority" delivery (which maybe halves the amount of delayed messages in our experience) or tell your customers to switch mobile providers (yeah, good luck with that).
As a service provider there is something you can do about it: Use well known out-of-band 2FA specs such as TOTP. Those are compatible with Google Authenticator and don't require a phone number, which is a massive inconvenience (not always available, not available in every country, SMS not reliable, requires an ID, not free, leaks personal information to the service provider, ...)
Well, yeah. We're not using SMS for 2FA, just for delivering monitoring alerts. With those reliability statistics (and the impossibility to improve it) I wouldn't do SMS-based 2FA at all.
We've found other interesting behavior in email-to-SMS services using it for alerts (this is in the US):
Verizon: will deliver all messages typically with low latency.
AT&T: Variable delivery latency and they have some sort of rate-limiting where if your system generates 10 alert messages within a short period, they queue them up for a couple of hours!
Inmarsat: Fast consistent delivery but they have an undocumented rate cap that when reached results in all (all!) messages being black-holed for 30 days. There is no way to reset this state. The cap is something 150 messages per month or 5 per 10 minute period.
Most services have the option of remembering your 2FA authentication on a certain device. For example, I have to enter my LastPass password in my computer to login, but I only have to use 2FA if I'm logging in from a new device.
I have my 2FA in Notification Center and consider this fine given that it's second factor. With that, it's about eight seconds for me involving one slide of my finger. I'm also mystified that you think support for 2FA and mandatory 2FA are the same thing, particularly for something like Netflix.
I am not arguing about support vs mandatory. Just that I am not convinced 2FA is a compeling alternative. At least the way I see it implemented.
I like the idea behind SQRL, which still requires another device, so still inconvenient, but at least it does not rely on the server sending a message through a slow protocol. The website displays a QR code, you launch an app, scan the QR code, this app connects to the server and authenticate you through cryptography. No login or password to type, no message to wait for or to copy manually. No privacy concern since it does not rely on a third party. I could live with that.
2FA doesn't have to be done over email/SMS. Nearly all websites these days support Google Authenticator protocol enabling use of a wide race of app/devices (for example my Garmin watch) to produce the code. No need to wait for an email/SMS.
This does sound perfect to me. However I worry about losing a token without a established way to replace it.
For me I don't like staying logged into most services, I find it very uncomfortable that my computer "remembers" me for some reason. I use a browser plugin to delete cookies on tab close and don't save any history. I'm not so much RMS, just like my browser to "start fresh" most of the time. I also use a VPN 90% of the time.
So I value quick login more than account security, I guess.
> 2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec.
That's definitely true, and it's definitely annoying. But one is not logging in every day (or even, I hope, every month: 90-day cookies are safe enough).
Yeah if it is really a critical service and rarely used, we should. But if I have to wait 30sec in front of a login box every time I go on netfix or on amazon, you can bet their sales will go down the drain.