Hacker News Reader

I don’t know the answer, but this is a pet peeve of mine.

It’s especially frustrating when sites won’t let you enroll for 2FA with a hardware token. Instead they require that you start with some crap “authenticator” app first. Looking at you here, Gitlab and ProtonMail.

View on HN

I believe Gitlab has supported hardware keys for years now. At least Gitlab.com, not sure about the self hosted one.

Also Protonmail supports both U2F and FIDO2. Introduced october last year [0].

[0]: https://proton.me/blog/security-keys

Yes, but in order to enable it, they require that you enable an app first.

I can only assume that this tactic is usually an attempt to maybe get your phone number, depending on which phone-based method you choose. Which is especially weird for ProtonMail.

It does not require a phone number.

Fwiw, Gitea now supports WebAuthn!

Reply on news.ycombinator.com