In Denmark, the current digital identification/authentication solution for pretty much any online contact with the municipality, state, etc. is being switched over to a setup consisting of the following steps:
- You enter your username on the site where you want to log in.
- You open the authenticator app (one specific, purpose-made app) on your phone with a six-digit code or touch/face ID.
- You approve the login in the app.
The username is treated essentially like a password in terms of "should not be known by anyone" (as expected, there have been problems with the site helpfully informing you that your username already was taken), but not starred out on any of the sites it's used. The developers maintain that the remaining combination of an authenticator app and a six-digit code to unlock it constitutes two-factor authentication.
Does this actually hold up? If not, does the username/password/userword/passname constitute another factor? (The best English-language description of the setup I can find is here.)
EDIT: I've now found a more detailed description in Danish and had time to translate it. To respond to comments etc.:
- The app can only be used when activated, and an activated app is personal. Activation is done either with the old authentication setup right now if you already have that or at a municipal service desk if you're registering from scratch. Registration involves an activation code shown on the screen and an 8-digit temporary PIN sent by SMS to a mobile number that either is already validated or is validated during registration by sending an SMS with another 6-digit validation code to that number
- the passcode is centrally validated (by "[zero knowledge password proof] technology combined with other technologies", however informative that may be about their implementation) though as I mentioned one can use biometrics to give it instead and they in fact suggest to do so for ease of use
- you do get locked out after a certain number of unsuccessful tries
- you can have up to three copies of the app attached to you, so if you have one on your tablet and one on your phone and lose either device you can use the remaining one to activate the app on your new phone/tablet; otherwise you have to do the registration process over again