Hacker News Reader

> Why does this matter, unless the only options for 2FA are insecure ones? Secure 2FA today won't depend on your phone number not changing.

The issue is the same with any kind of 2FA software or device.

If you lose, break, or replace your smartphone that has your 2FA app on it, you lose access to everything.

If you don't have a smartphone (likely to be the case for a lot of the people this Twitter thread is talking about), you have to get some kind of OTP generator device/dongle - which can also be lost.

Sure, but the tweet specifically said "consistent access to the same mobile number", not to the same device.

> If you lose, break, or replace your smartphone that has your 2FA app on it, you lose access to everything.

Most services these days provide recovery codes or secondary email/phone as an option.

> Google Authenticator and FreeOTP work even without network connectivity, so no phone plan is needed.

You still need a trusted, personal device to use those apps.

What if you don't have a personal device at all, how do you check your e-mail at a library?

I am all for taxpayer funded "everyone gets a WebAuthn token or two to put on keychain" and requiring banks and tax authorities use it. No SMS, ever.

People in USA would literally riot if required to carry around a government issued dongle.

Meanwhile they carry around literal spyware with FB, IG, Twitter, Alexa, Google Assistant, etc 24/7 and can't bear to be away from it for five minutes voluntarily.

You still have to carry something right? How is that different from carrying your phone?

It's on a/your keychain, wallet, or backpack, where phones are difficult to fit. It doesn't need wifi, recharging, or a battery or mobile plan. Anywhere you need to use it will have some way to connect it, like checking your email in public, tapping it against a phone to log in, etc. It's orders of magnitude cheaper than a phone and you can have numerous backup keys in safe places if needed.

If stolen, has little to no resale value and zero personal information on it, and you can unregister the key from online services

It‘s quite hard to provide a second factor if you can‘t have any belongings because you either lose them or they get stolen (eg. homeless people battling addiction). Personal devices and yubikeys are ruled out. Biometric features could be another factor, although hard to implement.

At a library, a staff member could create authenticator codes for people who often visit and are recognized by the staff. The visitor would then request to see the code if they need it. Of course this is a lot of effort for the library to identify people and the visitors must rely on their local library, they still can’t access their e-mail if they are on a device somewhere else.

Really like this idea!

Could you solve the identity problem with a real key, like for a safe deposit box, but unlocks a 2fa key?

I like your idea as well! In theory it could be solved, but that introduces new challenges, a 2fa key usually lasts for 30s and you have to be fast enough to enter it. For the start a staff person running around to peoples desks with a mobile device that has the codes registered could be more practical. The boxes will still only work for people that are able to reliably keep possessions to themselves.

There are a lot of ways to do 2FA that don't require a mobile phone. Does anyone remember the verisign key dongles?

Or for example one bank here in Switzerland will give you a calculator looking device where you insert your bank card, enter a challenge set of numbers, then enter your pin and get back a other set of numbers to enter where you are logging in. Might seem cumbersome but doesn't require a phone.