Hacker News Reader

Comment by bpicolo | Hacker News Reader

Not sure why there are complaints about it only working when the phone is online. Twitter will only work with a phone online anyway.

View on HN

This would prevent you from using twitter on a PC when your phone does not have internet connectivity. I.E. someone at an internet cafe in a foreign country.

It's possible to have computer Internet connectivity in an area with no cell phone reception. I go to a place like that about once a year at least, or so.

Maybe they are trying to tell you to stop tweeting about it, put down your phone and enjoy your vacation?

I appreciate the sentiment but let's be real, what problem did they solve exactly?

Twitter? They solved the insecurity and instability in using their previous SMS solution, and they don't hold the key to the second factor of authorization, in the event their systems leak.

I don't think they can be, as I don't have a Twitter account.

Certainly I would be pissed beyond belief if I tried to login to my bank (assuming they ever pull their heads out of their asses to support 2FA) and couldn't because I don't have cellular service in addition to Internet.

I already have this problem; both my bank and my credit union introduced 2FA but only with SMS. Once enabled, any attempt to log in using a not-yet-authorized browser or app is stalled until I get that text message. Presumably a call to customer service would sort it out eventually, but that prospect isn't terribly pleasant.

Every time I have to call customer support to reset a bank password it makes me realize how bad of a security hole most phone support is. Security through two-factor authentication is only as strong as the process for bypassing it.

Once a year? Store your backup S/KEY under your favorite keyring.

I thought his is one of the reasons they have backup keys which you can use when your phone is not reachable. I haven't actually tested the new system though.

Not sure why there are complaints about it only working when the phone is online, since you can generate a backup code offline and use that. Your phone does not need internet access once you have set it up.

Reply on news.ycombinator.com