Currently, the names of the two 2FA methods we offer are presented to the user as TOTP (one-time token) and Web Authentication (WebAuthn). These names are technically correct but difficult for end users to understand. We should rename these to more user-friendly names.
Security key
This term can instead mean any 2FA token regardless of type. Also it is too similar to "security code" proposed in T159915: Remove the word "CAPTCHA" from all Wikimedia user interface strings (though I oppose the latter task).
... and there are authenticator apps that can do more than TOTP. Microsoft Authenticator provides 3 different ways to be used.
It would be good to have the protocol name in the details somewhere (maybe behind an info button?) so people who want to determine whether they can use a specific app know what to look for. But yeah it shouldn't be mentioned prominently, it doesn't tell 99% of the potential users anything useful.
Wrt security keys, currently (since T399665) we support security keys and phones; but we don't particularly want to support phones (for now), it's just how WebAuthn works that you can't enable/disable the two separately. So it makes sense not to mention them, but then the browser UI suggests phones very prominently, so that might be confusing.
While the term could maybe mean other things, it has a much wider history of being used specifically to mean a Yubikey-style device. This also matches the terminology commonly used in the now-native browser and OS UX for WebAuthn, when they refer to these kind of devices.
Some can be used in other ways, but in terms of what someone needs in order to set up TOTP, "Authenticator app" is a reasonable prompt for what a user should have.
Change #1184591 had a related patch set uploaded (by Catrope; author: Catrope):
[mediawiki/extensions/WebAuthn@master] Add "add key" and "delete success" messages
Change #1184594 had a related patch set uploaded (by Catrope; author: Catrope):
[mediawiki/extensions/OATHAuth@master] New UI for Special:AccountSecurity
Change #1185160 had a related patch set uploaded (by Catrope; author: Catrope):
[mediawiki/extensions/OATHAuth@master] Rename the user-facing TOTP label to "Authenticator app"
Change #1185163 had a related patch set uploaded (by Catrope; author: Catrope):
[mediawiki/extensions/WebAuthn@master] Rename the user-facing WebAuthn label to "Security key"
Instead of questions of "what's TOTP" it'll be questions of "which option do I pick in my app?". And then we'll be fussing about "which app do you have".
This is frankly not a win. An actual win here is adding links, or supporting a help page, that tells people what to expect or need.
Some can be used in other ways, but in terms of what someone needs in order to set up TOTP, "Authenticator app" is a reasonable prompt for what a user should have.
And so, I assert, as you have asserted, is "TOTP". If you want, "time-based one time password", since that's what it literally expands to, but TOTP will be just as useful for finding an appropriate app for use.
So we can called them Authenticator app (TOTP) and Security key (WebAuthn). Such terms in brackets are not intended to be translated.
This is part of an initiative to make our on-wiki 2FA system more accessible and useful for a broader, less technical audience than is currently able/required to use 2FA today. As part of that, we're trying to remove as much technical nomenclature (including protocol names) from the copy and UX of the site. The users who would recognize the terms TOTP and WebAuthn are also the least likely to need help with this in the first place, so I think we should proceed with Authenticator app and Security key.
Authenticator apps are the area where we do still expect the most confusion, since their UXes can vary and we're more likely to be the first service that forces someone to consider using one (since unlike most other large 2FA-supporting sites, we don't support SMS). We have discussed suggesting specific apps, either inline or by more directly linking to our documentation that already suggests some apps to use. We should probably also update that documentation to make it more non-technical-user-friendly, and to provide instructions for common major authentication apps (like Microsoft's).
Change #1184591 merged by jenkins-bot:
[mediawiki/extensions/WebAuthn@master] Add "add key" and "delete success" messages
Change #1185163 merged by jenkins-bot:
[mediawiki/extensions/WebAuthn@master] Rename the user-facing WebAuthn label to "Security key"
Change #1184594 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] New UI for Special:AccountSecurity
Change #1185160 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Rename the user-facing TOTP label to "Authenticator app"