Hacker News Reader

The browser won't help you avoid putting it in the login form at google.com.fakehackersite.com which can then just relay that to real google.

I think this is still an improvement over SMS, and personally is something that risk wise I'm happier with than the idea that if I lose a yubikey or it breaks down it's game over.

View on HN

Ah, i see. definitely a concern for if i were administering an org. I still like TOTP vastly better than the only alternative with wide reach, the dreaded and stupid "code sent via SMS" but I hear you on the risk with unsophisticated users who click things.

Maybe this WebAuthn thing will catch on and help? fingers crossed.

> I hear you on the risk with unsophisticated users who click things.

The evidence says this attitude of "it's other people who get phished and not me" is pure arrogance. Practically all sophisticated security professionals can be phished with sufficiently sophisticated attacks, if the underlying system is using a phishable credential.

Reply on news.ycombinator.com