Hacker News Reader

Comment by otabdeveloper4 | Hacker News Reader

What's the alternative? Government-issued FIDO2 keys? Good luck with that.

I'm quite content with simple passwords on most accounts. But there is also email challenge, non-authority-issued security keys, and authenticator apps. All solutions that are currently being used by consumer-facing companies, and generally considered more secure and often less privacy invasive.

Yeah, I'd at least like the choice of which one(s) to use, but more and more services are specifically requiring a mobile phone number, and requiring SMS 2FA, which is blatantly ridiculous (and I agree should be outlawed). Thanks for totally locking me out of my account while I'm overseas...

authenticator apps +1

What about people who don't have a smartphone?

You could get those little mini RSA token things that are just a battery-powered thing the size of a USB stick. I assume those are still around... haven't used one in years tho.

These are pretty insecure because OTPs are easily phishable. WebAuthn devices are just as inexpensive, but prevent most phishing attacks.

They'll get a government-issued ankle monitor/smartphone..

Couldn't you just set up a text service to request a one time token? That way you could fall back to SMS, but it wouldn't be required.

(e.g., anyone could create a service that someone could use, which would allow them to request a 2fa code to be issued over SMS at any time after enrolling it via the OTP pairing process)

What happens when the attacker uses that fallback to perform the exact same attack that they perform today?

There is no smartphone requirement in RFC 6238. Smartphones are simply the device that a lot of people use as their user-agent, but you can use a computer if you prefer.

https://www.rfc-editor.org/rfc/rfc6238

I don't care much for third parties inserting themselves into (and likely collecting data on) things that have nothing to do with them. What kind of authenticator app would make it impossible for the maker of that app to know who I am or what services I'm using and when/how often I use them?

Reply on news.ycombinator.com