Hacker News Reader

Reading this reminds me of a gripe I have; is it possible to use 2-factor authentication on gmail without a phone? You can print a list of OTPs but you can't enable it without also registering a phone number. Given how easy it is to intercept voice and SMS, that seems like a huge security hole.

View on HN

The device doesn't need to be internet connected if you use the app. An iPod Touch does the job just as well as SMS, though you need to make sure the times are synchronized.

Still doesn't answer my question. It won't let me turn on 2FA without giving them a phone # that can be used (SMS or voice) to authenticate, which means anyone that can redirect my phone or capture my SMS messages (both fairly trivial in a targeted attack) can bypass 2FA.

Even if they could duplicate the SMS at that moment, you would still be protected if you use the app.

You have to just do that once to activate 2FA. Once activated, switch to mobile app. No one can turn it off without having code and password later. (apart from finding some flaw in system)

It's counter based, not time.

Reply on news.ycombinator.com