Hacker News Reader

Comment by Alupis | Hacker News Reader

I used to be quite annoyed with 2FA (although I understood the value)... and was particularly annoyed when one of my banks made 2FA mandatory.

Begrudgingly shlupping myself to the other room to locate my phone and get a texted code...

But, after receiving 3 different password reset emails in a short period for different services, I decided to enable 2FA for everything that supports it. Where possible, choosing the Time Based 2FA instead of texting codes (just in case I lose my phone or something).

With the right mindset (and paranoia), I'm coming around to viewing this inconvenience as necessary, and wish more services supported it.

View on HN

The kind that Google and Microsoft (and maybe others) do is pretty great. You get a push notification on your phone and just tap "Yes", and you're in. Of course, you should still have a fallback like OTP for when your phone is not internet-connected, but it feels really seamless and is a very minor inconvenience.

I got a little U2F token that I leave plugged into my laptop and set it up on everything that supports it. It's really nice because you don't have to stop and hunt down a code, or a phone or app, just tap the side and it lets you in. I just wish more sites supported it.

In terms of both UX and authentication strength it's infinitely better than SMS/email/TOTP 2FA in every way. (My understanding is most alternatives, including SMS and google auth type TOTP, are still vulnerable to MitM attacks whereas U2F tokens solve that too).

If you have 1Password it makes software-based 2FA so easy that you'll barely notice it's on. Though I haven't been able to find a single US bank that supports software 2FA.

Does 1Pass support 2FA or otherwise handle it? I have been using 1Pass for years, but use a different app for my MFA.

You could also look at Bitwarden. I'm not affiliated, but it's an amazing password manager (desktop app, mobile apps, browser extensions). Even better, it's fully open source; you can even run your own server to keep out a third-party being your (encrypted) sync server. I've been using it for a couple of years now, and have never had a single problem. Free for personal use of almost everything… an upgrade to include the two-factor auth you're looking for is a very cheap $10/year.

Yep. If you have the desktop app installed, look for Two-Factor Authentication under Watchtower and it'll tell you all the sites that can use it. It's easy to set up too, it can scan a QR code on your screen. Some people believe that it's more secure to not mix your password manager with your 2FA though, since it's not "true 2FA".

Reply on news.ycombinator.com