Hacker News Reader

Ah, i see. definitely a concern for if i were administering an org. I still like TOTP vastly better than the only alternative with wide reach, the dreaded and stupid "code sent via SMS" but I hear you on the risk with unsophisticated users who click things.

Maybe this WebAuthn thing will catch on and help? fingers crossed.

View on HN

> I hear you on the risk with unsophisticated users who click things.

The evidence says this attitude of "it's other people who get phished and not me" is pure arrogance. Practically all sophisticated security professionals can be phished with sufficiently sophisticated attacks, if the underlying system is using a phishable credential.

Reply on news.ycombinator.com