Hacker News Reader

Comment by 0xbadcafebee | Hacker News Reader

E-mail seems to be the solution. It's out of bound; authentication/authorization are required; there's standards to flag an invalid origin; filters spam. It's not encrypted, but neither is SMS. Most of today's dumb phones can check e-mail, so it's almost ubiquitous. The only way it doesn't work is for rural users who have no data but do have GSM/SMS.

View on HN

I agree, but unfortunately some regulatory bodies like the EBA have specifically labeled it "not a factor for 2FA purposes"...

Ironically, my email inbox is much better protected than my SIM/phone number.

We should lobby them to change the rules, as a second e-mail account would literally be a second factor. Then it's up to the user to hook it up to their phone.

Email based authentication is lame. If a hacker gets access to your email, then they automatically have access to your 2FA. Lame.

So if a hacker gets access to your second factor, they have access to your second factor?

And if they get access to my phone number they get access to my texts and phone calls. That's why neither should ever be the only authentication factor (nor a single-factor recovery method for that matter).

That said, my phone number is significantly easier to take over than my email address and mailbox.

Most (but not all) free email providers now seem to require SMS verification to sign up for them these days.

True, but at least you need an SMS-capable number only once (to sign up), and not every time you are trying to authenticate to some "secure" website.

Reply on news.ycombinator.com