Hacker News Reader

Only banks do that. All other services accept TOTP (which you can have on multiple devices) or YubiKeys/webauthn/U2F (where you can add multiple hardware keys).

And even here, my bank accepts two (or more) devices with an active instance of their app. So the solution to this spof is the same as always: redundancy. You need a second phone. Your old one is probably good enough.

View on HN

I've never seen a bank accepting more than a single device with an active instance of their app.. I would be over the moon if they did but they don't. So, last time I broke my phone, it took quite a while to get access to my bank accounts again.

My bank (Polish mBank) even have a section in the webUI to manage these devices along with other access channels.

> Your old one is probably good enough.

Some of us use the same phone for years, until it loses OS/security updates. My current phone is 6 years old. By the time I upgrade, my current phone will not be able to run current authenticator or bank apps, which will target an iOS version above the last one supported by my phone. So no, my old one is not "good enough" unless I upgrade more often than I'm comfortable with.

Funnily enough, I just had a meeting with a client asking why they would need two (and then likely more) servers doing the very same thing. Wouldn't that increase the price? Well, yeah.

Reply on news.ycombinator.com