Hacker News Reader

Comment by joshstrange | Hacker News Reader

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA?

I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

View on HN

Yeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.

>2FA is a very cheap solution

If you don't know the technologies the website is built upon or how much it will be impacted by increased barrier of entry for users, this statement is baseless.

Who uses malbolge to create servers?

I take offense at your tone, and the implied judgement. Malbolge was the right tool for us, and let us tap into a talent pool that was otherwise going unused.

The one thing I dislike about 2FA as a user is, if I drop my phone in a lake, can I safely recover my account? I have a lot of time, money, effort, etc invested in my accounts, and I really don't want to lose that

If you use something like Authy or 1Password to store your 2FA tokens then they aren't lost if you lose the phone. Does this mean a single point of failure and in someways undermine the use-case for 2FA? Sure but as with all things security you need to decide where on the spectrum you want to be. It's a game of trading security for usability base on what your situation requires.

You can write down on paper the private key you get when enabling 2FA. Some providers also give you a list of recovery keys.

If a website is smaller it may not be sticky enough for a user to feel they get enough value to put in the effort to do 2FA

That's totally fair, but you don't have to force 2FA on your users.

For good and bad, I happen to like social media for logins... Twitter, fb, google, ms all offer them. In the end if you get their "real name" and email address, I find that generally sufficient. You don't have to do the actual authentication, users can configure 2fa on their own.

I mean, some site do ask for way more than they need here and that's often bad. In the end, I think it's a reasonable trade off for end-use convenience. Which I often am.

Reply on news.ycombinator.com