Hacker News Reader

Comment by privateSFacct | Hacker News Reader

This.

I deal with relatively higher volumes of information that must remain secure.

With google, I have hardware authentication device and 10 codes.

Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write it down. This feels like a reasonably secure approach.

No SMS text option. The idea that your phone number is the key that allows you to reset all your passwords (no matter how complicated / securing no matter how much sensitive info) is ridiculous.

View on HN

> No SMS text option. ... ridicolous

Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0]

[0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-...

I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked..

They stole your SIM. SMS option was now in their control.

SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.

Everything you said agrees with what simonebrunozzi said. SMS is a bad 2FA option.

> sure its better than not having 2FA but only a little better.

I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.

Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone.

Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.

If the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.

No, as other threads have pointed out, SMS is trivially hacked

You do realize that the minimum wage worker at your local phone store can setup a new phone with your number?

That they may have friends who they accidentally do this for?

That they may not detect the fake ID some random person with your name and number shows them?

Etc etc. None of this requires getting your phone.

The problem is that twitter forces you to add a phone number, and once that phone number is added it will automatically be able for 2FA. If you don’t believe me then remove your phone number and wait. Eventually you’ll login and get a message saying your account is suspicious and you need to add a number.

> sure its better than not having 2FA but only a little better

Only if the provider doesn't decide to be "helpful" and start allowing password resets via SMS on your 2FA number.

Any redundancy on that piece of hardware?

"Two is one and one is none," as the Special Operations folks will explain.

Sure, the math is squirrely; but the sentiment is real.

The recovery codes.

Reply on news.ycombinator.com