Hacker News Reader

Comment by x0x0 | Hacker News Reader

Except 2fa doesn't work in practice unless you're an expert.

See eg gmail: you can't set up 2fa without supplying a cell (you will be allowed to remove it later, but how many know to do this?) Your phone number is trivially stealable -- see eg youtube video of people just stealing phone numbers with a crying baby and a sob story. https://youtu.be/F78UdORll-Q?t=133

Also, lots and lots of places have trivial routes around 2fa because people losing their password and/or 2fa is an order of magnitude more common than theft.

View on HN

2FA works in practice against people who don't have physical contact with you. For most people, that's the only threat vector they're worried about.

It hardly makes your life more difficult, and it does help at least a little bit. So it's worth setting up.

Not really; sms as 2fa has regularly enabled people to steal accounts they otherwise couldn't have gotten by allowing password resets by stealing your phone number.

See eg @deray getting hacked.

If a password reset is allowed by pin that's not two factor authentication, that's SINGLE factor authentication. I know we tend to think of 2FA as anything involving a pin sent to your phone, but it does require two factors.

GMail, for instance, will not allow a password reset with just a phone pin.

Google actually lets you use a physical key to protect your account.

https://support.google.com/accounts/answer/6103534?hl=en&ref...

I wonder why you cant get a pre-paid at a kiosk. Use a burner phone. Yes, you need some time and effort but if you need good security you will suffer some inconvenience. BTW register the SIM with your spouse or parents name so that there cannot be an easy connection to _any_ of you accounts. Remember also to top-up your prepaid SIM occasionally.

An non-contracted burner phone in your spouses name that is used to send cryptic looking messages.

That seems like the kind of thing that'd get you on an intelligence agencies watch-list..though these days it's rather hard to find something that wouldn't.

Reply on news.ycombinator.com