Hacker News Reader

Comment by matt4077 | Hacker News Reader

I don't think it's about the money, it's more of a matter of capability and simply "caring". Regarding the latter: it seems that Apple has managed to build an organization where everyone knows that details matter and everyone identifies with their work.

Here's a wonderful example: two SMS, one from google and one from Deutsche Bank (who, at the time, probably had enough money to care about details) https://twitter.com/salzprojekt/status/707303168703602688

Both SMS have the same purpose: sending me a single-use login token. But only google thought enough about it to change the sentence structure so as to make the code visible without unlocking the phone.

View on HN

Is the point of 2FA to show you have possession of another device, or access to another device? While I'm in the same boat and appreciate seeing the code above the fold, for really secure things I'd prefer the Deutsche Bank example.

They leave that choice to the user since you can disable the content of sms appearing on the lock screen. Not that I think that it's a good idea to leave security decisions like that to users

I noticed that since I have iMessage synced to my Macbook, if I ever lost my laptop and someone tried to hack my accounts, they would get the 2FA access code on the laptop they stole.

Those codes come across as actual SMS messages to the associated phone number. It appears on your laptop only when the phone is near enough to it that the "continuity" feature is engaged. You should be safe from this threat as long as the laptop isn't lost very nearby.

That is not true. SMS messages arrive as long as the phone is online, regardless of location.

I've never seen this behavior with my own devices, and cursory searching turns up similar results. Certainly I could be wrong, so can you point me to any references that describe the "proximity not required" behavior?

Well no. I had my iPad on a trip and left my phone at home plugged into the wall. Could send and receive text messages without problems

Sending and receiving non-iOS/iMessage texts require your phone to be near your computer. I don't believe any company sends 2FA codes to you through iMessage.

Google's is a more convenient general-case solution, but Deutsche Bank may actually want to trick the user into reading the sum and the purpose of the transaction before he or she gets to the code. It could prevent a race condition type of attack if the user's PC is compromised.

Reply on news.ycombinator.com