Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

> Web is still there and better than ever, and works on every platform too (as it always did).

We're talking about an MFA solution, no? There's really no way to do that with pure HTML/CSS, you need some sort of TOTP generator.

IMO, this is why 2FA should always be optional, but the rest of the world seems to disagree with me...

View on HN

U2F has been around for a long time and has worked great for me for email (and is more of a real second factor than TOTP: you just plug it in and push the button and it does its crypto thing). There are similar newer standards like FIDO2. I think some of those standards work with smartphones too (haven't checked recently)?

Why is SMS auth (like my bank does, with plain HTML/CSS pages) not sufficient?

Anyways, my government is sending me SMS for auth anyways and won't stop anytime soon. No need to introduce yet another requirement on the citizens.

Because it's too easy to convince carriers to port someone else's phone number to a new SIM. I wish the carriers would address that, but that too would likely require some sort of government intervention.

Alas, if only the government could provide government intervention? Since they can't, we're left only with the option of government intervention to mandate use of android or iOS?

In fact, intervention wouldn't have to be to change SMS. They could instead mandate a standard like U2F or FIDO2. If they really don't like those for some reason, EU states could get together and make a new standard and mandate that.

I agree with this take! I was trying to defend the Digital Markets Act, and was responding to someone who (as far as I could tell) appeared to be fundamentally against any or at least most government regulation.

Yeah, especially if it's not absolutely necessary (e.g. the goal would be otherwise impossible).

I'd be okay if they regulated telco carriers a little bit more than they already do; much more okay than with anything resembling what they're trying to do now.

Reply on news.ycombinator.com