Hacker News Reader

Comment by milesward | Hacker News Reader

Repeat after me: we need FIDO2 in exactly the same physical form factor as your house key. Give ‘em away all over the place, make it the default conference swag. SMS is not good.

View on HN

I mean... please don't trust a random key given to you at an event by someone you will never see again and might not even be affiliated with the company they are claiming to be from to not have a copy floating around in a database?

Agreed, but they need to be sold cheaper first. A YubiKey costs me around $40 and it’s the only brand I trust.

That’s inaccessible to a lot of people.

And then there are UI/UX constraints. The Venn diagram of "knows how to use SMS", "knows how to use 2FA" and "knows how to use yubikey etc" does not have a lot of overlap outside a tech audience.

They used to offer an $18 yubikey, but the cheapest one today seems to be $25. So a bit better than $40 but still way more than say a house key costs

The FIDO2/webauthn ones (the Security Key series) are $25 for USB A or $29 for USB C. You can't use them for storing OAUTH keys, they're not smart card compatible, they can't store your PGP keys, and can't create one-time passwords or store a static password securely... but they are cheaper.

Built-in to laptops and phones is the only way we’ll get mass adoption

What happens when you lose it?

FIDO keys should only be sold in 2-packs in my opinion. You should never have a single key as your second factor.

That being said, one-time use backup codes are a standard way out of the problem.

> That being said, one-time use backup codes are a standard way out of the problem.

Hardly any services seem to give that option unfortunately.

But I don't carry a house key, because my door is opened by my phone.

Reply on news.ycombinator.com