Hacker News Reader

Comment by minhazm | Hacker News Reader

It may be safer but it is way less user friendly. If you lose your phone with Google Authenticator (or any competitor), you will lose access to your accounts. You'll need to find your backup codes or go through the process to reset your accounts, which can be very cumbersome. Once someone has to go through this process they won't want to use 2FA anymore, I've seen it happen to many people.

But if you break or lose your cell phone you can just get a new one, and you have access to your 2FA token again immediately. It's much easier for people to work with. Yes it's less secure technically, but that sacrifice is worth it for a lot of people.

View on HN

You can backup your 2FA TOTP qrcodes to physical cold storage, and you can keep backups. Most non-technical people understand the process of "keep this print out safe + secure"

However you can lose control of your SMS phone number any number of ways that are beyond your control.

It's frustrating that so many providers push SMS as the only 2FA, when there are so many problems with it, and TOTP is provably better, privacy preserving, and much easier to work with.

I don't know if you ever worked with tech-illiterate people, but there is no way that they would print out or write down a list of codes or keep something in cold storage. Hell, even if they know how to. It's too much effort for something like email, and yet they wouldn't realize the importance until it's too late. I personally had to deal with an aging woman who had her online banking password set to her name followed by the year she was born in, and was unwilling to use the USB security key that the bank started providing. There was more than a million in her account. She couldn't be fucked to secure that kind of money with a free-of-charge easy to use key. It was not a case of an elderly woman struggling to remember her password or not understanding how to use it. In her mind she deserved the access to her account just on the merit of it being "hers", and she saw the security as an unnecessary ritual that the bank used as a barrier between her and her money and nothing could convince her otherwise.

That is a fair assessment in some cases, but I have also assisted tech-illiterate elderly folks with bank accounts in non-US banks. Keeping a printed list of codes (one time passwords) was in-scope for accessing the bank online, as well as other silly tricks as an on-screen keypad with rearranged numbers.

I think there is too much emphasis on catering to the lowest denominator to the point of sacrificing privacy and autonomy , rather than raising awareness and education.

There are authenticators out there that can run on multiple devices and have multiple backup and restore options (with SIM Swap prevention) like saas pass.

Reply on news.ycombinator.com