No to sms. Yes to alternatives.
Any update on this?
Not yet unfortunately but this is still high on priority.
Thanks for quick response 
I already have to keep 2 different authentication apps not mentioned in the poll for other entities. Would really like not to have another. SMS is best.
SMS is not as secure as using app auth (I.e google authenticator)
If not SMS, then Duo Mobile or FreeOTP please.
I too, prefer 2FA (google authenticator, Okta, YubiKey) methods other than OTP. OTP is susceptible to MitM attacks.
2 Likes
However, in retrospect, I would actually prefer some sort of biometrics for accessing the app. Most modern phones now support facial, retinal, and/or fingerprint recognition.
1 Like
That is what Iām hoping for so when I open the wyze app Iāll be asked to use face ID to access the home page.
Here is the apple developer documentation on it
1 Like
Voted for Google Authenticator, but Duo Mobile is also a great option. Duo has great resources for developers looking to integrate 2FA. That said, if SMS is easier to implement immediately Iād rather have weak SMS 2FA than no 2FA at all until a token-based method can be implemented.
Iām also in favor of having email notifications for any account changes like new app signins, cameras added/deleted/shared, Many online services already do this and itās an relatively simple backend change.
Iām less concerned about locking down the app on my phone with biometrics etc. since thatās already required to unlock the phone itself. Unless you typically hand over your unlocked phone to other people I donāt see why you would need a separate lock on the app.
1 Like
I agree with you I wouldnāt mind the SMS for now but hopefully they do move into using tokens because I run all of my supported 2FA apps through Google auth and itās super convenient to have everything all in one place.
When it comes to having biometrics I prefer having the extra security for example if my phone gets taken or someone who I lend my phone to gets curious. Itās not a priority feature but would be nice to have eventually.
Whatever method is chosen, for me it is a must have to have the option that it not be required every time you use the app, but only for logins on unknown/new devices.
My phone is already locked down biometrically. I donāt need to be asked to unlock the app every time.
3 Likes
For me it isnāt an issue to have a second biometric lock due to how fast and easy it is to use face ID I could see it becoming annoying if you have a phone that doesnāt have touch Id/face id and have to enter a pin in each time but thatās why they can make the feature only be enabled if you toggle it on.
1 Like
Regarding your poll, and data in your spec document, a little flawed for data collection. Google Authenticator, Lastpass Authenticator and Authy use similar enrollment methods. Yes, you can integrate with some to push approvals to the device, but all support the same QR code based enrollment to deliver a rolling code back to you.
Better to skip SMS / Email notifications, unless you are looking for a simple checkbox to say you have the feature. They are both clunky, and SMS is insecure. Industry is moving toward token / app code based authentication for a reason. Any way you look at it, placing it as a tier 3 priority is a miscategorization in my opinion.
2 Likes
What about FIDO2 and U2F?
1 Like
Hello, Community Membersā¦
For those of you that would like to attain a better understanding regarding the pros/cons of different authentication methods, but are too hesitant to askā¦ I listed 2-articles below for your convenience.
ā¦andā¦
NOTE: If these articles are not appropriate to list in the forum, then @Loki or other moderator can remove this post.
2 Likes
Completely agree. SMS is only a short term solution with known vulnerabilities. It would be better to develop 2FA with authenticator app support from the start with eyes on long term support for the standard. Also, and I might be wrong, but Iām pretty sure that 2FA through authenticator apps would have lower running costs than having to maintain a service to send SMS tokens to customers.
Personally, I think the fear of using SMS is overblown. The first vulnerability (SIM swap) would be readily detected because your own phone would stop working on your number. The 2nd vulnerability (SMS intercept) would really depend on a very knowledgeable hacker targeting you specifically. For something like cameras, Iām just not worried about this. Having SMS 2FA in place would be so much better than nothing and make it likely that any hacker will pursue and easier target.
The article itself even says:
Remember, using two-factor authentication via SMS is better than leaving 2FA disabled. And itās probably unlikely that you will become a victim.
3 Likes