Hacker News Reader

Can I ask why app-based 2FA is significant to you? If you're on your phone, wouldn't someone who can access your password manager on it also be able to access your 2FA app on it?

View on HN

Phone numbers can be remapped to new sim cards:

https://nakedsecurity.sophos.com/2016/08/12/sms-or-authentic...

I'm confused, how is this relevant? I was asking about app-based 2FA.

That would require physical access to my phone, and access to the content on it, vs convincing a telephone company to transfer my cell number to a different sim. I'm less concerned about the former.

I may be misunderstanding your question?

I think you inserted SMS into this where was none? I was never suggesting he use SMS over this.

He said he’s currently using SMS so it’s natural to back-track your question to SMS based 2FA. The reason he wants to use app-based could very well be the one stated above - because the [main] alternative is easy to hack remotely, and that required physical proximity is a feature in this case.

Huh, I see. I didn't get the impression he's using SMS. I thought he was just describing the feature Chase offered, not that he was actually using it. I'm not asking about SMS 2FA at all, I'm asking what app-based 2FA itself would protect against. It seems like an extra step that wouldn't really help anything.

Reply on news.ycombinator.com