Hacker News Reader

It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry.

Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.

View on HN

Authenticator tokens are pretty robust systems. I'd like to see more services start to make use of them.

Definitely, as long as there was a common standard (and open source, of course). Have a keychain token that you can link to accounts, then enter a password on that and it gives you a (time limited) key to use to login.

Reply on news.ycombinator.com