Hacker News Reader

Backup codes are a way to bypass the 2nd step, so what works that even mean?

No - you need backup codes and something else, like a password, SMS OTP, or access to the recovery email address.

Well yeah. If the recovery process is weaker than regular authentication, that's what bad guys will use for account takeover. You don't want to lose Gmail because someone bruteforced your backup code?

It would not be weaker then usual authentication... you would still need username and password.

Not sure why companies nowadays rely on your tiny device to provide a second password. Both my passwords and 2FAs are on that device, what security does it add?

And why do they need a password if they are going to require Timestamped-2FAs anyways?

Reply on news.ycombinator.com