Hacker News Reader

> The only privacy friendly method is no 2FA, just long secure passwords. Which is why 2FA is pushed so hard ...

This is absolutely ridiculous and so clearly false I can't help but wonder if it's intentional misinformation.

There are numerous open source TOTP authenticators for both the desktop and mobile that require absolutely no data to be stored in the cloud or shared with third parties.

I myself use KeepassXC and Keepass2Android.

View on HN

Not to mention, like, fido/u2f based systems which don't have any privacy concerns I can think of, even theoretically.

So you store the password and the TOTP in KeePass? Seems that you have 1FA, hacking your KeePass is enough to own you.

No, that would be silly. They're stored in separate databases with different passwords.

If I was really paranoid I'd keep the TOTP database on a separate device but, frankly, I don't anticipate being the target of a motivated attacker so that's more than I feel is necessary given the threat models I'm concerned about, those being untargeted hacks (service breaches, driveby attacks, etc) and social engineering.

Reply on news.ycombinator.com