Hacker News Reader

Comment by zitterbewegung | Hacker News Reader

Adding a phone number that people KNOW about can make it LESS secure. A workaround is to get a phone number that is only used for identity verification and not given out to anyone.

View on HN

That sounds like a good fix, but a tall order for most people.

One way to accomplish this would be with, ironically, a Google Voice-type service (but associated with a completely independent email provider)

This can actually be problematic. I've found many 2FA services use text services with shortcodes which sometimes do and sometimes don't work with services like Google Voice. Back when I used Voice, my actual cell number was only used for identity verification.

Not really, there are phones out there that have two SIM-card slots.

This works as long as they don't insist on verifying you through that secondary phone number (this is the case for now for Google I think - if something suspicious is going on, they ask you if you want an sms with a verification code, or an email to a secondary address; but maybe not all services with 2FA make this optional).

It's not fun to have 2 phones always with you. But maybe the 2-SIM devices will become more mainstream soon, which can solve this problem.

You don't have to have a second phone (or even just a SIM card) with you, you can keep it at home.

The reason why they use phone in the first place is that you will always have it with you. The reason why you have your phone with you is because you use it to make phone call. Unless you are suggesting to buy phone that supports dual SIM cards, I think this idea is not very practical. Why not have physical TFA device instead (they are usually much cheaper and lighter than a phone)?

That's a good point. Though I think it would be challenging to have a phone number that no one knows which you also carry around with you.

It's possible if you use something like Google Voice for most of your regular calls, but you still need to make sure that the telco can't tie your name to your number…

A solution would be to not add a phone number, and store the password in a password database instead.

Reply on news.ycombinator.com