Hacker News Reader

If you don't have a google-enabled android device (as I don't), and you've registered your Yubikey with google (as I have), they won't use the Yubikey they will SMS you instead.

Seems like they prefer google prompt, then SMS, then the actually secure stuff.

View on HN

I just went to the bother to confirm that, exactly as I expected, Google just asks me for my Security Key when I sign in. This is what their UI says they will do, and sure enough it is in fact what they actually do.

So whatever you're seeing is not in fact some sort of Google policy to prefer insecure SMS.

Ok. So it's not google then, it must be AWS or python-aws-google-auth (or my install of it.. which has python-u2flib-host enabled)

Reply on news.ycombinator.com