Hacker News Reader

Comment by devwastaken | Hacker News Reader

Or, allow it, and inform them there's a safer method called Google authenticator. Authenticators make your logins dependent upon 3rd party software, and is only as secure as how that single source of failure is.

View on HN

There's many 2FA apps compatible with the TOTP and HOTP standards and they rarely, if ever require an update.

Absolutely minimal 3rd party involvement, I'd say less than most web browsers these days as there really isn't a significant attack surface for the apps.

If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive:

https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a...

https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

https://github.com/google/google-authenticator/wiki/Key-Uri-...

It always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.

Many of these services, I believe google is one, still require mobile phone as a fallback option.

Paypal, an actual bank, still only allows SMS 2fa. It's stupid.

Wrong. TOTP is supported, although hidden.

https://www.paypal-community.com/t5/Tips-from-Moderators/Pay...

It uses Verisign's VIP app instead of Google Authenticator (or Authy or whatever).

You can use any TOTP app.

According to some threads I've read it doesn't work in all circumstances.

Personally I wouldn't risk it since it could mean risking getting locked out of your account.

I've been using it for a few years now and I haven't encountered a place where I couldn't use it. It might force you to enter the TOTP code at the end of your password though, but it works.

It's not hidden, it's de facto disabled for 99% of users. Fix this, Paypal.

And even this option is not available in all countries. I've almost stopped using Paypal completely because of this.

Google requires at least 2 ways of 2fa protection. You can enable a third one and disable the phone completely.

Requiring the phone number is mostly an anti-bot/spammer measure. Once they've seen your phone number you don't need to let them use it anymore.

Reply on news.ycombinator.com