Hacker News Reader

Secret questions don’t help with security but tend to make it worse. Not only can they be phished conveniently along with the password, they also make for a poor UX. Also, SMS is no longer considered a secure channel. Use a more secure second factor instead, such as WebAuthn.

Blocking an account after a number of failed login attempts is an invitation for DoS. Use a system of temporary blocks instead; for example, 2^n seconds after the n-th attempt.

View on HN

I was reading about WebAuthn. What if my security key gets stolen?

One common method is to secure the hardware key with a PIN. The key will only do its work (e. g. sign things) if the correct PIN is entered. It will also destroy the secrets it keeps (or even itself) after a given number of failed attempts.

If this is not feasible for some reason, you need to change or revoke your secrets as soon as you know the key is stolen.

Reply on news.ycombinator.com