Hacker News Reader

Just gonna point out that AWS IAM only started allowing multiple 2fa devices 2 years ago.

https://aws.amazon.com/blogs/security/you-can-now-assign-mul...

It's entirely possible that many sites shared this flaw.

Correct, AWS was one of a small handful of services I was thinking about which did have this restriction but now haven't had that restriction for multiple years.

Reply on news.ycombinator.com