Hacker News Reader

Comment by pnw | Hacker News Reader

OP's problem sounds like failure to plan. If you are going to suspend your cell plan, you should probably check your authenticator works or have a backup option before you travel to another country.

I don't know what the viable alternative is. Passkeys have just as many issues when phones are stolen, lost or broken. You cannot expect consumers to store recovery codes. I do agree support of TOTP authenticators would help savvy consumers, but probably still too complicated for seniors etc. Watching my elderly relatives with poor vision enter a TOTP code was quite instructive. The UI of Google Authenticator made no sense to them and they didn't understand why it kept changing and getting rejected. They were barely able to enter six numbers in a 30 second window.

View on HN

A viable alternative is to offer multiple 2FA options, one of which should be RFC 6238 TOTP. The author would have probably planned ahead by selecting that rather than a proprietary app or SMS.

> you should probably check your authenticator works or have a backup option before you travel to another country.

They may sign you out automatically if you connect from a different country.

TD Authenticate does not require a network connection. I outright disabled network access for the app on my phone.

Don't know how he got logged out but he almost certainly didn't check before leaving the country.

Having said that, the 2FA for TD is atrocious as it provides SMS fallback in addition to their bespoke app.

hardware tokens are the way! Everyone has had a house key their whole lives, and understands how to keep a spare to prevent lock-outs.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account.

-s

The only bit we're lacking is the "tied to one's bank account". The rest already exists in the form of yubikeys and other hardware security tokens.

Your bank/credit/debit/etc. card is a “physical token with a crypto key that is protected by a password and tied to one's bank account”. FIDO and EMV even both use the same underlying ISO/IEC 7816 and 14443 protocols for communications.

Ah! I forgot about my debit card. I only use it ~once per month. Yeah, we'd need an additional piece of hardware to be able to connect it to our computers but that also could enable doing chip-based transactions over the internet so I think it would absolutely be worth it.

I know this was sarcasm, but bank card is not appropriate because you should have one hardware key for all services produced by an independent provider.

Why would I want to have one key for all them? To lose access or get them all compromised at the same time?

I think your threat model is bad — the isolation of accounts offers little and most people have effectively only the security of their email provider anyway.

That said, buying several keys would be a natural and happy path solution for the paranoid. Make sure to get three for each account (same as primary) as either you need a backup or the extra key offers no extra security.

Some of us don't want to have a dozen plus separate physical tokens (one for each of bank/credit card/tax, etc sites with sensitive financial information we have).

Okay, I will make the "S" mark bigger next time.

Not how it works. One key can keep dozens of entries.

I know plenty of people who have lost house keys. I have many Yubikeys and I am responsible with my things, but not everybody is like us.

Hardware tokens are a PITA. Sure everyone has a house key because they only have a house at a time. I have 3 bank accounts, a few brokerage accounts, some pension logins on top of the regular stuff. I'm not going to carry 15 hardware tokens with me.

You only need one, plus a couple recovery spares, in any sane implementation.

SecurID tokens suck but with FIDO2, you'd only need one key.

Of course, that breaks the UX analogy of the house key.

One thing I like about the Aegis authenticator app is the clear way it changes colors and even flashes to indicate a code is getting ready to change, so it is less common that you might start copying digits, glance away, and then finish copying digits from a different code.

But, I think it would still be a challenge for many elderly for other reasons.

Reply on news.ycombinator.com