Hacker News Reader

> you get an email from the same address used to setup the accounts...

Isn't one of the biggest selling points of 2fa that if one account gets hacked you don't lose all accounts?

The selling point of 2FA is that if a hacker gets your password (from a DB dump from a compromise of site A that has bad security and no PW hashing) and tries to use it on site B, then site B still won't let them in because they don't have the second factor for site B.

In this case, an email account is the second factor. Your Github password is the first factor.

No, multifactor authentication uses different forms of evidence (i.e., something you have, something you are, something you know), not just multiple accounts. Given password reuse, cookies, etc., e-mail is a terrible second factor.

Reply on news.ycombinator.com