Hacker News Reader

Agreed. Good write-up, but bad title.

It was surprising that you could disable 2FA without using your 2FA. That seems like a big flaw.

It’s difficult because if you lose access to your 2FA before you remember to remove it from accounts, which would be the typical scenario, you’re in a bad spot. It happened to me once with PayPal after being forced to quickly change my phone number.

The lesson here is to not leave your password manager logged into any machine other than the ones you know are secure themselves. I only do for my phone and personal machine.

That makes sense and is a valid reason to allow removing 2FA without having your (lost) 2FA. However there's still the fact that there was no notification that it was removed.

Reply on news.ycombinator.com