Hacker News Reader

>> you now have single-factor authentication

In many cases that factor is now Google's security vs. the same reused password that is your hobby + the year you graduated high school. It this is what makes it convenient enough to always use, it's probably still a step up. It's at least a better, slightly more distributed factor. And even then they're distinct systems, possibly not even within the same cloud.

It's less secure, but the single factor is a stronger single factor than a password because it can't be reused. If someone mitms my login they get my password and otp code, which they ideally can't turn into something reusable (if the website requires 2FA to change security settings) and definitely can't use if they have a lag between collection and exploitation (like a keylogger that phones home every so often). This is acceptable to me, but I would prefer websites let me use a one time code as a single factor of authentication.

This.

It is a real problem that a lot of people fail to understand why this is an issue.