Hacker News Reader

Comment by seldo | Hacker News Reader

My biggest problem with 2FA that relies on a phone is that I can lose my phone. If I do, the system can then do one of two things:

a) it locks me out forever. I'm screwed.

b) it has a way to reset my auth. Meaning an attacker doesn't actually need my phone.

So getting the phone involved is either a huge risk or a pointless feel-good factor that can be bypassed. Either way, I'm not on board.

View on HN

This is where one time codes that you keep in your wallet come in.

Many second factor auth systems use this. There is a list of 10 codes that can be used once each (and they're only valid used in order, so only one is valid at a time). You print this list out and keep it in your wallet or wherever else in case you lose your phone. If you lose both your phone and this list, then you are in fact screwed.

Two factor is something you know (but can forget) and something you have (and can loose). The risk is there, regardless of the thing you have being a phone or key fob or smart card.

Losing your phone is not the same as losing your phone number.

+1. And in a world of VoIP that can be both good and bad ;-) That said, if you use Google Authenticator, it's just a backup away. And you can add additional numbers, which again provides that tradeoff between security and convenience. At the end of the day, high value targets should be defended in depth, with least exposure to attacks and easily dropped if compromised. Which means maintaining inbox zero on servers others monitor but are less shared (so you can phone someone) and implementing login systems without failsafes. Of course, IMAP wasn't built for much of this 2FA stuff ;-)

Reply on news.ycombinator.com