Hacker News Reader

Comment by imrehg | Hacker News Reader

Was just trying to set this up, and not great (IMHO).

The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used the username+somestring@gmail.com trick to reuse my address, as one email can be used with only one twitter account...) then change it back.

View on HN

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.

Additionally, it requires an active phone number, which may not be available to you in general or temporarily.

It's possible for an attacker to intercept the SMS based 2FA http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-an...

> Curious, why is SMS-based auth a downside in your opinion?

If I go 40 miles south I'm in ( the Republic of ) Ireland and can't receive SMS.

Airplanes are a big one for me as a frequent traveler. Every plane has wifi but you can't receive SMS. If my previous cookie expired or the site thinks the plane's IP is new and strange, then I might have no way to sign in from the air.

How much tweeting do you do on an average flight?

Reading tweets is perfect for a flight, it's a never-ending stream of entertaining information that doesn't require a lot of concentration.

No phone network for me why I go back to my parents place so it's complicated.

Try spending a bit of time traveling. I've been on the road for almost a year. My phone number changes every month or two (or more depending on if I'm buying new tourist SIMs everywhere I go).

Nobody else has mentioned this, so maybe I'm an odd-ball, but I don't like giving out my phone number to ad-based services, especially social media sites. What do they do with that information?

It feels like data collection veiled in security. Giving out more personal information is the exact opposite of everything I've learned about privacy and security.

Yeah, no Google Authenticator is a deal breaker for me too.

Thanks for posting about tricking it to confirm email -- I was in the same boat.

Reply on news.ycombinator.com