Hacker News Reader

Comment by mindslight | Hacker News Reader

How about just making it illegal to use phone numbers for digital authentication? 95% of the problem solved right there.

The current setup feels akin to the longstanding problem of companies using social security and driving license numbers for authentication. Only the industry speedran the creation of this new problem, so they should be expected to get rid of it just as quick.

View on HN

What's the alternative? Government-issued FIDO2 keys? Good luck with that.

I'm quite content with simple passwords on most accounts. But there is also email challenge, non-authority-issued security keys, and authenticator apps. All solutions that are currently being used by consumer-facing companies, and generally considered more secure and often less privacy invasive.

Yeah, I'd at least like the choice of which one(s) to use, but more and more services are specifically requiring a mobile phone number, and requiring SMS 2FA, which is blatantly ridiculous (and I agree should be outlawed). Thanks for totally locking me out of my account while I'm overseas...

authenticator apps +1

What about people who don't have a smartphone?

You could get those little mini RSA token things that are just a battery-powered thing the size of a USB stick. I assume those are still around... haven't used one in years tho.

These are pretty insecure because OTPs are easily phishable. WebAuthn devices are just as inexpensive, but prevent most phishing attacks.

They'll get a government-issued ankle monitor/smartphone..

Couldn't you just set up a text service to request a one time token? That way you could fall back to SMS, but it wouldn't be required.

(e.g., anyone could create a service that someone could use, which would allow them to request a 2fa code to be issued over SMS at any time after enrolling it via the OTP pairing process)

What happens when the attacker uses that fallback to perform the exact same attack that they perform today?

There is no smartphone requirement in RFC 6238. Smartphones are simply the device that a lot of people use as their user-agent, but you can use a computer if you prefer.

https://www.rfc-editor.org/rfc/rfc6238

I don't care much for third parties inserting themselves into (and likely collecting data on) things that have nothing to do with them. What kind of authenticator app would make it impossible for the maker of that app to know who I am or what services I'm using and when/how often I use them?

Reply on news.ycombinator.com