Hacker News Reader

"What's the alternative? SMS 2FA is abysmal."

It seems to be forgotten that email 2FA exists.

I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ?

There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.

View on HN

The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails).

Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.

if someone gets access to your phone they can do way more damage, but this is accepted.

It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale

Reply on news.ycombinator.com