Hacker News Reader

Seems like a reasonable default would ask for your second factor if you attempted to remove it or add another, as these are potentially account compromising events. And since these changes should very rarely happen, it's not exactly an onerous requirement for everyday users.

View on HN

I suspect there is a common use case where someone’s phone gets stolen so they lose the 2nd factor and have to disable it or add a new device because they don’t have the backup codes either.

As with all things security, there are trade offs.

And they actually do have an extra high security option, with warnings that if you're not careful you could lose access permanently.

I actually think their existing policy is not so bad at all, but it should notify you.

So: 1. Changing recovery emails should require 2FA

2. Changing any 2FA policy should email your recovery email

It does, after all, still require a password. We're really talking about a very, very specific use case where the attacker has a lot of access to an existing session.

I myself have had a phone break and rushed to a computer with a valid session so I could easily reset. It's really a huge UX win, and probably massively reduces 2FA burden/ support burden.

Reply on news.ycombinator.com