Hacker News Reader

If anyone from Zerodha tech team is here, I wonder what's the reasoning behind Zerodha's weird 2FA setup? A static password + a static pin is not really 2FA IMO. What's the problem with supporting standard hardware or app based 2FA that requires an OTP?

View on HN

Hey, you can turn on biometric 2FA on your smartphone, or use TOTP (Kite web -> My profile -> Password and security).

The static PIN is a legacy hole that has to be plugged. Coincidentally, we wrote to the regulator about this exact same matter recently. We'll hopefully see a regulatory announcement mandating "real" 2FA for everyone.

"The static PIN is a legacy hole that has to be plugged. "

...and probably never will be.

Reply on news.ycombinator.com