Hacker News Reader

This is why I use two factor authentication for my email. It's a usability nightmare, but not as much of a nightmare as losing all my accounts everywhere.

View on HN

Two factor is magnitudes better than password only, but it's not foolproof.

Security is only as strong as the weakest link. CloudFlare was hacked recently because the attacker was able to redirect voicemail to another account, then use the two-factor backup recovery phone option to take control of Google Authenticator.

https://blog.cloudflare.com/the-four-critical-security-flaws...

You can no longer recover a Google account via a voicemail message, and AT&T now allows you to lock changes to your account with a passcode. And, the people that committed this particular attack are now in jail awaiting trial.

Usability nightmare? It requires you reenter a code from your phone once a month.

Google's is pretty easy to use, but the problem is that it doesn't scale to other providers. In addition to my phone, I also have a PayPal credit-card-sized token, and my brokerage only issues key-chain RSA keys. So now I have to have my phone, my wallet, and my keys with me in case I need to use certain websites. It would be better if everyone agreed on a standard algorithm and used it, but that's not what's happened.

Hence, a usability nightmare.

Reply on news.ycombinator.com