Hacker News Reader

Comment by dale_glass | Hacker News Reader

2FA is an odd thing to have a problem with.

Open source today is absolutely security critical. If you have commit access to something like say, libjpeg or some other such widely used component, you make a very, very juicy target for attackers.

And it's hard to tell whether you are in such a category. You may not know that your small tool library happens to have made it into some big software product.

Also, Github's 2FA doesn't require SMS. You can use Google Authenticator just fine. It's just a secret obtained by scanning a QR code, your phone number is not involved. Yubikeys and similar are also supported, as well as authentication via the mobile app.

View on HN

The mention of phone numbers also confused me. You can even store the secret, which shows besides the QR code, somewhere else and use oathtool --totp --base32 to generate tokens without a smartphone.

It took me a non-zero amount of time researching to discover all that--it's not like the GitHub information spells that out as an option.

That is true and I mentioned oathtool in order to spread my knowledge. At least this trick can be used for almost any 2FA method.

And, more and more keep bothering me with this, e.g., when trying to read Google mails via Thunderbird, you have to create 2FA in order to create an application token that can be used with Thunderbird. So many tokens and passwords. It really keeps getting on my nerves and I don't trust things that are locked onto my smartphone because it might get lost. The first reflex was to simply save the QR code, but then I also wanted to know how I could use it without Google authenticator and so I found oathtool. And as can be seen from the two necessary command line arguments, the default oathtool invocation also didn't work out of the box.

To be fair, Google and also Github, both, provide recovery codes, which can be used if you loose your 2FA device. But now you have basically 3 "passwords", two Yubikeys, plus your associated mail address, all of which you have to remember or store. All of this just for a single account out of a thousand, which you aggregate over a decade or more.

Exactly, the phone number thing is quite an illogical jump.. I think the author has a problem with Microsoft more than anything - I can't help but think you'll enjoy life more by not looking to be outraged, all the best to this individual.

I'm using the Yubico Authenticator with a Yubikey on Windows, so you don't even need phone-based authentication. Yes, you do need a yubikey for these to work, but I prefer that to handing out my phone number to these 2FA services.

> 2FA is an odd thing to have a problem with.

The author explicitly states in the post that that is not the issue:

"I have nothing against the concept of 2FA. I voluntarily use it elsewhere. That’s not what this is about."

It's not really clear what their actual problem is. There are two points being mentioned, collecting phone numbers (which is false, can be done without), and a misunderstanding of the whole protecting consumers motivation.

Reply on news.ycombinator.com