Hacker News Reader

Were you using a VPN or something? I’m curious if this was tripped by setting off impossible-travel flags or something. It seems plausible that this is just anti-account takeover logic working as-expected, but with a false positive alert.

View on HN

Anti-ATO should not clear out security keys that have been registered for a long time. If suspicious new keys were added, it should clear those.

From the audit log in my email no new keys were added before this was tripped.

I am not using a VPN and as far as I know I am not doing anything unusual. I might be committing the crime of having a Linux Firefox user agent but I somewhat doubt that was the problem, that's not that unusual.

I was hoping that using hardware keys would eliminate some of the security hoops that we have to jump through. And it does seem to help. But the whole reason that I have a key is so I do not have to supply my phone number, and I have a more trusted way of proving my identity, even if I am connecting from an unusual location.

Reply on news.ycombinator.com