Hacker News Reader

yes, i agree completely.

but! how many keys to your car or to your home have you got? i'm willing to wager that you've got more than one. in the same way you never should have one key to your account, especially with hardware keys, but 2fa code apps should also apply.

View on HN

If I lose all the keys to my car or they are destroyed, I can pay a dealership to create new ones for me, I don't just have to forfeit the car.

At any non-shady dealership, you should presumably have to give some sort of evidence that you own the car in question (registration documents etc. and ID matching the name on the registration). For many online accounts, you probably don't need (or want) to give ID when creating account, so that's out as a way to prove ownership when attempting to recover. So how else do you prove ownership?

I did this recently actually, bought a car where the owner only had a valet key. Had to email them a copy of my registration, my driver's license and the VIN, and they ordered me a new key.

For important accounts I wonder if we should have the ability to tie them to a physical address or something else possible to verify.

Far too many sites don't allow more than one hardware key for 2FA. I set up 3 yubikeys on those sites that allow it.

Reply on news.ycombinator.com