Hacker News Reader

The same could be said about passwords. This device is probably best used as part of a multi-factor authentication scheme.

View on HN

That's why everyone says "don't reuse passwords". Making something like this and calling it "secure" is misleading, at best.

This is useless as multi-factor authentication, because it turns it into single-factor authentication. Anyone sniffing a single session or seeing it once knows what it looks like, and can reuse it on any site. It's much, much weaker than TOTP/HOTP, for example.

I did some more reading on the site, and it appears that the product is not aiming at user authentication. For example, they suggest that you might use it as part of a loyalty program. The end user brings in their smartphone with an app and the business stamps their phone as proof that they were physically there.

Ah, it makes much more sense instead of a username. Odd, the title is a bit misleading, then.

Reply on news.ycombinator.com