Hacker News Reader

I signed up for OpenPhone just now, but then noticed that the only thing you need to log in to someone's account is their email and a 6 digit code emailed to their account. There are no password or 2FA options. I haven't tested how rate-limited the login attempts are, but it seems like too much to ask for customers to trust that they exist and work, especially when the apparent attack success probability is already > 1/1M.

View on HN

Your access to your email account is your password (magic link-esq). Agreed that 2FA is desirable (not sure if it's on their roadmap, will have to ping them and ask). If 2FA is a hard requirement, building your own solution on top of Twilio is preferable (as they require 2FA).

Thanks. I agree with you, except a 6 digit code is worse than a good random password, or magic link with e.g. 64 bits of entropy.

Reply on news.ycombinator.com