Hacker News Reader

I'd hardly say people routinely bypass Google's two factor authentication (using the smartphone application), which is what I'm suggesting here.

I'm aware of one incident (the Cloudflare hack), but that seemed to be more a vulnerability in the password reset functionality than the authentication mechanism.

SMS verification is less than ideal, though.

View on HN

Doesn't Google fall back on SMS or a phone call if you no longer have access to the authenticator app?

I know I have a printed sheet of one-time codes, but I think if an attacker compromises the phone number on my account, I'm screwed.

You can disable that, so that the one-time codes are your only backup method.

Reply on news.ycombinator.com