Hacker News Reader

Any 2FA is inherently susceptible to losing one of the factors. It's designed to deny access when only one factor is present, so this is kind of a feature not a bug, and part of the security-vs-convenience tradeoff. Do you have any specific reason to think SMS 2FA in particular is a terrible idea?

View on HN

Not if you have a password-protected Yubikey with GPG/RSA signing, encryption, and authentication keys and a second backup Yubikey with the same keys. If you lose one, order two more ASAP, use the backup key to change your keys in every machine and revoke that key (thereby rendering the lost Yubikey and your backup useless). Wait for the new Yubikeys to arrive, generate new keys, change all machines to these new keys, and revoke the temporary keys you generated.

For 2FA specifically, SMS is weak because of its vulnerability to SIM swap attacks[0]. There's been a few reported incidents where attackers stole cryptocurrency from accounts protected by SMS 2FA[1].

[0]: https://en.wikipedia.org/wiki/SIM_swap_scam

[1]: https://btcmanager.com/sim-swap-attacks-amplify-companies-re...

Reply on news.ycombinator.com