Account Protections – A Google Perspective

elie.net

1 pointebursztein2 comments

Interesting talk. I should say although hardware keys are effective, websites often fall back to SMS if that’s not available, essentially defeating the purpose of hardware key.

Isn’t that the case with Google account also?

Thanks :)

Regarding security keys, actually it depends: if you are enrolled in advanced protection no you must have two security keys and we don't fall back. For normal users that is the case yes. Until phone as a security keys is widely used and security keys are main stream the no fall back option can't be the default but hopefully we get there :)

Reply on news.ycombinator.com