Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by swiftcoder | Hacker News Reader

Parent Full thread

swiftcoder·

> you have to download an app to do it, it's not just a capability that a phone has by default

Luckily this is starting to change. Apple's Passwords app does TOTP out of the box.

Though I am mystified why Google Authenticator doesn't come pre-installed in Android.

View on HN

For the longest time Authenticator was almost abandoned by Google, so it's not surprising the team responsible for the bundled Android apps swerved it.

It didn't need bells and whistles and constant security updates, but it took 13 years for it to get cloud-sync support so you could backup your codes.

TIL! Thanks, I had no idea Passwords did this until now.

Doesn't this kind of defeat the purpose of MFA in that you now have both factors within the same application?

You don't actually need MFA. This whole thing came about because people reuse passwords between websites and websites have their databases hacked all the time so the same password can be used to log in on other sites.

2FA codes solve that because you can't reuse them between websites so one website getting hacked doesn't expose all of them.

You can easily reuse TOTP between websites, but not many websites let you set your own TOTP secret. They could easily do the same for passwords, but none do.

SMS 2fac isn't any better in this regard, since you typically receive the SMS on the same device that stores your passwords.

Reply on news.ycombinator.com