Hacker News Reader

Comment by dvhh | Hacker News Reader

not useable in all country. Not applicable on imap, pop3. Use case where an email account serve more than 1 physical person. Unusable while you travel.

View on HN

"Unusable while you travel" or in other countries is simply false: one of the two-factor authentication options is the google authenticator app on your smartphone, which requires no internet/phone connectivity at all. It's time-based.

The imap/pop thing is still a legitimate concern. App-specific passwords let those continue working, but they have security issues of their own.

And yet another option is a set of emergency use codes that you write down or print on a card.

It's quite possible to add two-factor logins for any protocol, that works in any country with a cell phone network. Just demand a response to a challenge via cell phone before validating the password, you could even require one of those RSA token thingies if you want. Just a matter of cost and convenience.

Not everyone has a cell phone.

I used 2 step verification for my gmail. Our cell phone operator cannot receive international sms (I know, that sucks), so I used my home phone, so every time I logged in to my gmail I received a call from google voice robot to tell me the pin number. It sounded perfect at first, but when I started to actually use it, I noticed everytime I needed to login to gmail, I wasn't home. I'd call my parents so they could say me the pin or use the backup codes that google provided me with. That was so uncomfortable I had to turn it off.

Reply on news.ycombinator.com