Hacker News Reader

Comment by 127001brewer | Hacker News Reader

... Just as we should no longer trust SMS for two-factor authentication, we shouldn’t trust it for account recovery. Disable this anywhere you can.

This is interesting, but, instead of SMS, what should be used for 2FA?

View on HN

From the article: personally, I recommend (in order) U2F, Push-based and TOTP/token-based

TOTP tokens?

Presumably, TOTP tokens not delivered via SMS

DigitalOcean does this, but then they fall back on SMS in case you uninstall the TOTP app.

This is unfortunately quite common. Facebook won't even let you use TOTP unless you have a validated phone number to use as a fallback.

Furthermore, you have to install their entire app to use TOTP. Their app includes everything but the kitchen sink, and murders phone batteries even when in the background. On top of this, I don't see a point in installing apps if the functionality is also provided by their website. If I'm using my phone for 2FA, I'd like my phone to be secure, and I trust the security of my phone with just Chrome on it more than I trust my phone with Chrome and a million other apps.

this is the comment I was looking for. not only do they do this (which is not a good excuse), they also BEG you to put in your phone number every other day.

I've seen websites (I believe it was netflix) which ask for your phone number in order to provide you a way to reset your password... what happened to good old email resets?

Which they pretty much have to - what happens if you drop your phone and break it?

Reply on news.ycombinator.com