Hacker News Reader

Comment by kylehotchkiss | Hacker News Reader

I wish there was some credible government authority to clearly tell services they cannot offer SMS only 2FA, they cannot limit to “mobile phones only” (ie no Google voice), and they can’t restrict TOTP to one off proprietary tools like Authy. “Person is within USA with mobile phone plan” is hardly an authentication scheme.

View on HN

And also that they must offer users the possibility of disabling SMS-based authentication if another scheme is enabled.

On Microsoft 365, if you setup "forced MFA" on your organisation, then they additionally force users to add a phone number which can be used for account recovery.

I get why Microsoft wants to keep account recovery possible in this manner, but I am not someone who needs it, and there needs to be a way for me to make my account more secure where my phone company can't take over my account...

You can actually stop the MFA onboarding process when it asks for your phone number—just close the tab or window. You’ll still get TOTP or whatever else you already configured. It makes it sound as though you also need to add a phone number, but you don’t.

I just ran into this. My bank used to send codes over email, but for some reason a couple of months ago they decided SMS was the only option.

I said "So you're forcing people to have a phone with a plan?"

"Yes."

Phone companies should have banned SMS 2FA as an abusive use, or at least charged extra for senders. What it does is offloading KYC to mobile phone subscriber databases.

It is in all the parties’ best interest (too big to fail business, mobile network, and the government). No accountability, low cost, and the ability to finger point.

How does the TOTP secret get copied into Authy? Seems like you could just copy the data out of that and into an open source tool instead of Authy.

The TOTP URIs can be exported - I use this to export them into Bitwarden: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Reply on news.ycombinator.com