Hacker News Reader

I am a passive user only reading things related to 1 specific thing and some time ago when logging on I was informed that I can no longer use 2fa for my account because security costs extra. Don't remember the details but it appeared absurd.

View on HN

SMS 2FA was put behind the paywall - ostensibly because they saw "bad actors" abusing it, but more likely because it costs money to send text messages and they're bleeding like a stuck pig thanks to Musk.

App and keyfob-based 2FA is still free.

Also non sms 2FA is much more secure. Telecoms are famous for garbage security. There are naughty places on the web where you can essentially buy the privilege of taking over a targeted phone number courtesy of a compromised employee account. For instance T-mobile has reported major widescale breaches in 2023 and purportedly small scale breaches where an employee account is taken over and used to essentially sell control of customers phone number are much more common to the point there was a telegram channel set up specifically for this purpose and hearing "T-Mobile Up" was a common occurrence.

I have for instance entirely disabled SMS 2FA wherever possible and strongly prefer my yubikey.

Reply on news.ycombinator.com