Hacker News Reader

> The without recourse is the part that matters...

Yes, and I'm saying that part isn't accurate either for the story you're portraying with passkeys or for the status quo. That's not how account recovery flows work.

View on HN

With passwords, no account was even lost in the scenario for a recovery flow to start. An account recovery flow is only necessary because of the superfluous extra security, which will almost inevitably introduce more attack vectors than before (such as a social engineering attack through customer service) if the banks want to service customers like grandmas.

> With passwords, no account was even lost in the scenario for a recovery flow to start

Given how common mandatory SMS 2FA is for banks, if thieves stole your unlocked phone, they have stolen your account too.

Isn't the SMS just 1 factor, and for 2FA they will also need the other F (e.g. password)?

Relying on only SMS sounds like 1FA?

Reply on news.ycombinator.com