At 11:02 PM a text comes in from Maya: “can I use your Netflix?” Most of us have had that message, and most of us answer it the same way, by sending the password.

I drew that minute twice to see where each answer leads. The two phones below start out identical. On the left I text Maya the password, and on the right I send her a Multifactor link.

The usual way

The password now sits in two message threads on two phones, for as long as either of us keeps them. That part happens the moment I hit send, and it's the part nobody thinks about again.

Then Netflix sees a device it doesn't know and sends a code to my phone, so I read it out to Maya. The first one has expired by the time she types it, and I send another. Once she's in, the site offers to sign out other devices, and she says yes, which signs me out too. Then she changes the password so she won't forget it.

Nobody did anything wrong. At every step Maya did what the screen in front of her asked. Seven minutes later she's watching, and it's her password now.

With a link

On the right I send a link. I connected the account to Multifactor once, earlier, by signing in with its password. Tonight I create a link for Maya and send it, with its pass in a separate message.

Maya opens the link, enters the pass, and lands on the account already signed in as me. She doesn't need a Multifactor account. The page comes from a secure browser in the cloud that Multifactor keeps signed in, so my password never reaches her browser.

The link also decides what she can do there. On Hacker News, no link can change the password or sign anyone out, not even one with full access, so the two steps that locked me out on the left can't happen on the right. If she tries one, it's refused before it reaches the site, and I can see the attempt in History along with everything else she did. When she no longer needs access, I revoke the link and her tab tells her the access was removed. There's no password to change afterwards.

It's still 11:02. Maya's in, and it's still my password.

Why two phones

I first drew this comparison for our landing page. The rule I kept to was that nothing differs between the phones except the answer: the same minute, the same request, the same hardware and the same thread layout. Anything else that changed would have been a second variable, and the picture only works if one reply at 11:02 decides how the rest of the night goes.

The numbered notes sit outside the phones so the threads still read like real conversations. The night on the left is made up from the ways a shared password usually goes wrong, so treat it as a composite rather than a transcript.

Try it

Netflix isn't one of the sites Multifactor Lite supports yet. Today it works with Hacker News, and our goal this month is to go from one site to dozens. Sign up at lite.multifactor.com, connect your Hacker News account, and send a link to a friend. It takes about two minutes.