Hacker News Reader

Comment by hot_gril | Hacker News Reader

Google Authenticator makes it very unclear to average users how you back up or transfer stuff to other devices. Sites that support Google Auth are gonna have to deal with lots of locked-out users trying to recover access, which can negatively impact security.

If anything hopes to replace SMS, it needs to be as user-friendly as SMS.

View on HN

Google auth is not the only authenticator that supports TOTP. Any time a site tells you to use google authenticator you should be using a better service like 1password, bitwarden, lastpass, etc... to scan the QR code and store the TOTP code.

I'm flabbergasted every time I switch jobs and some jamook in IT or Security says we have to sue google authenticator and that other authenticators aren't allowed. Then there are constant lockout events generating tickets for those teams when people delete the app or get new phones.

Yeah, it needs to be clear to users that they can use other things, especially some built-in option. Currently it's not.

Many services will happily remove the authenticator from your account if you email them and say you lost it. The whole thing is a joke.

Indeed I was once ordered to implement oauth but keep the email password reset because too many people would get locked out otherwise. And I almost locked myself out while testing.

It syncs everything to the cloud by default these days: https://arstechnica.com/security/2023/09/how-google-authenti...

Reply on news.ycombinator.com