Hacker News Reader

LOL the place I work now has some passwords in the password manager that say "call the eng director for the 2fa" because the service only uses SMS 2FA.

Like google voice or similar doesnt exist.

View on HN

While this seems weird, it actually somewhat qualifies as an insecure 4 eyes. Ofc the eng director can act without another party, but for anybody else this usually involves at least a short "sure, what are you trying to do?".

Google voice and other "non-traditional"/VoIP services are sometimes blocked by websites sadly.

P.S. dishonorable mention: Apple Business Manager uses SMS 2FA only, at least you can have multiple admin accounts

Reply on news.ycombinator.com