Hacker News Reader

Comment by dsmithatx | Hacker News Reader

This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords and then use the six attempts randomly on each account I reset. Sure I'd only get a small percentage but, I would easily start hacking FB accounts. It's things like this that make me use 2FA as much as possible on personal data.

View on HN

2FA is nice unless you lose your cell phone or it gets stolen. If you ever lose your job or go homeless and can't afford a cell phone then you are locked out of your accounts.

I am disabled and struggling if I miss payments I go homeless or can't pay my bills and things get shut off. For me 2FA might not work if I am down on my luck.

There are ways around this for some things but, probably not with services like Facebook. For example with Amazon I use 2FA with a cellphone. As a backup I use a hardware token and an Admin account. If my cellphone gets stolen I pull the 2FA card out of my wallet.

Provided that nobody steals your wallet and you don't lose that card.

In that case you use the backup codes that you had printed and put in a safe a register a new 2FA token.

When setting up Google Authenticator for One Time Passcodes, you are also given a seed which can be used to resteup the app from another device.

Provided you don't lose that seed. If I end up homeless will lose all my stuff and limited to library access. You have to plan for the worst case scenarios with 2FA when things go bad.

Well at a certain point getting locked out stops being 2FA's fault and is simply due to the user's lack of responsibility.

Authy is really good. https://www.authy.com/

They need a Firefox extension but its allowed me to do 2FA on my personal and work accounts without fear of being totally locked out if I loose my phone.

Don't Authy store some of your secrets server-side?

You can choose to store some, yes, but it's encrypted by your backup password. At least that's my understanding of it.

I recently bought the cheapest phone I could find for 2FA. 10$ phone and 20$ minutes. It equated for 400 texts with a time limit of 3 months. I didn't do too much research but there are probably some that don't expire. So, if you ever find yourself in a tough spot, 30$ can get you access. If you ever can't afford 30$, get in touch and I'll send you a phone.

Facebook likely makes the challenge harder if there is no history on the device you are trying to reset your password on.

Reply on news.ycombinator.com