Hacker News Reader

Comment by lakpan | Hacker News Reader

Tangential: Is anyone else getting burned out from having to transfer data between phones?

Let me explain. I’ve been rocking the same iPhone backup since 2010 and I never lost anything… but now if I lose my phone I will lose my eSIMs, as well as any non-passkey 2FA. What next?

Just recently I was unable to reinstall my eSIM for an hour and my headache was growing stronger as I imagined what all the services that (still) relied on SMS 2FA, all of which would not be activatable without it.

Switching to a new phone now requires me going through my long app list to determine which apps “probably” need to be reactivated on the new phone, while still having access to the old phone.

Back on topic: now I also have to worry about my location history being lost forever should I need to uninstall a buggy Google Maps (happens just about yearly)

View on HN

This is part of why I hate 2FA implementations that force a specific app. One of the sites I have to be able to log into added 2FA that requires a specific app, even more annoyingly, if setup with another app, the setup isn't outright rejected, it just produces the wrong totp.

It's much more convenient to have a yubikey+backup or something with a sane backup/sync system (eg password managers like Bitwarden).

Can’t speak to eSIM problems, but I’ve moved as much to synced passkeys as possible, and the last of my 2FA/MFA in Bitwarden will be migrated as those sites support passkeys.

As long as the data on my device is synced to iCloud storage or backups, that meets my needs. If the UX around an app is not great when switching phones or requires some esoteric incantations, I just won’t use it.

> As long as the data on my device is synced to iCloud storage

But is it though? That’s the major catch. Something as important as Google Authenticator is not backed up, so you must enable sync to your account to ensure you don’t lose it (which wasn’t a thing at all until recently)

Google Authenticator can sync to your account, now, meaning codes will be available from any new device.

https://security.googleblog.com/2023/04/google-authenticator...

That’s what I said, and I think it’s opt-in. GA is just one of many who silently opt out of iCloud.

> you must enable sync to your account

I don’t use nor recommend Google Authenticator. If you want a secure 2FA/MFA, use a hardware token or a passkey. TOTPs without a backup or sync is pain waiting to happen.

Of course, syncing TOTPs comes with its own threat model. Something to keep in mind.

Sometimes you don’t have a choice. Sometimes even if have that set up, the service will still send an SMS.

I recently moved my wife to a new phone. It took only a couple of minutes to transfer the esim. But SMS was blocked for 24 hours. Some kind of security measure? So I couldn't activate any apps that required 2FA via SMS. Quite a hassle.

eSIM is a failed technology. Instead of making it easier to move, they just gave the operators more control. In some cases, transfers are simply not possible (like with most eSIMs on Airalo)

Reply on news.ycombinator.com