Hacker News Reader

Comment by exabrial | Hacker News Reader

Please, no more SMS Authentication. Hacker news readers are in a unique position to prevent this "feature" from entering products. Let's work on putting this idea out to pasture.

TOTP, while not perfect, is an improvement. The protocol could be improved to provide protection against proxy attacks, but the point I'm trying to make is that your regular user can use TOTP. I've successfully set it up for my parents (both closing in on 70years old and are not tech-savvy) and they have no issues using it.

Personally I use a hardware U2F key everywhere I can. With the newest version of Safari Tech Preview _finally_ supporting U2F, I'm hoping we see some deeper market penetration.

View on HN

I have something like 200 accounts stored in my LastPass account, and my main problem now is that I have no idea which of my accounts use SMS for 2FA. There was a period of time where 2FA was synonymous with SMS, and a further period of time where using a hardware key or authenticator app required setting up SMS first. I'm trying to clean it up, but it's a mess out there. Some accounts require a phone number and don't have an option to disable SMS as a option.

What I would like to see is software U2F keys that browsers sync for you. I'm sure this would upset some people but I don't think the average user has the ability to understand and maintain a set of security keys. Furthermore you have to maintain the keys separately for each site. This means that I only use 2fa for a small number of valuable sites, because the pain of rotating the credentials is huge.

However most people I know have browser sync set up. They are using it for passwords. It would be great if it could manage a security token for them and allow authentication to websites without risk of leak.

I'd love to start recommending hardware keys as a go-to over TOTP but I often find that the cost is not great (taking mostly the Yubikey and Titan into consideration). Especially for people that aren't all that bothered with securing accounts in the first place, they see it as an unnecessary cost.

Same for companies a lot of the time.

Are there any cheaper, but still reliable hardware keys nowadays?

When I researched on the best/popular TOTP apps some years ago, I found Authy being highly recommended. When I tried it, I discovered that it first needs a phone number that it verifies through an SMS code. I promptly removed it and switched to another one (called OTP Auth).

Reply on news.ycombinator.com