Hacker News Reader

Comment by vel0city | Hacker News Reader

Most common example, I log in to my bank, they say they sent an SMS, I sit there waiting to access my account, then 20 minutes later the SMS finally actually gets delivered after I've given up and left to do something else. Rinse/repeat.

Or another example, someone hijacks my SMS'es, and then they log in as me.

SMS sucks. SMS is insecure.

The amount of times I've experienced customers complaining about SMS 2FA not working well despite it being on their carrier failing to deliver the messages in a timely fashion really showed me how terrible it is.

View on HN

Dunno what to tell you. Several possible points of failure there. Maybe your bank's system for sending SMS just sucks. Maybe you're in a place with poor mobile network coverage (which is a real problem for SMS 2FA, I agree, having lived in a place with nearly none for several years).

But for me, where I live now, with my bank, and my phone carrier, it works great. Never had a problem that I can think of. Typically, the SMS arrives within seconds. It's the least annoying and most reliable 2FA method I use.

I'm not that worried about potential security issues. Sure, it's a possible problem, but pretty low on the list of things to worry about.

The least annoying and most reliable form of 2FA I use is tapping the touch sensor, doing a biometric face unlock, or typing in my PIN on the device I currently have in my hands. Its miles less annoying and way more reliable.

Glad that works well for you. Does not work well for me. I do not care for laptops except when necessary and have come to loathe my phone. Everything important is done with desktop computers that do not have cameras or touch sensors, so biometrics can't work.

In general, I do not have a "device currently in my hands" and having to pick one up and unlock it is annoying.

> I do not care for laptops except when necessary and have come to loathe my phone.

Good news then, this also works on desktops, even ones without cameras or touch sensors. That's a part of why I mentioned "typing in my PIN". But sure, keep moving goalposts. Maybe next you'll tell me real computers don't have numbers on the keyboards or something.

> In general, I do not have a "device currently in my hands" and having to pick one up and unlock it is annoying.

I agree, which is why SMS sucks so much for 2FA. Having to have my phone with me with signal just to auth into something sure is annoying, I don't know why anyone would prefer that compared to just using the authenticator physically inside their computer.

"Good news then, this also works on desktops, even ones without cameras or touch sensors."

All of the 2FA methods forced on me by my employer and most online services that require it require a phone app. So no, it doesn't work on a desktop.

This is a discussion about passkeys. You've now shifted the goalposts again to "only the 2FA options my employer allows".

Which, while I can't speak to your specific employer, tons are moving to support passkeys. Largely because forcing these apps suck and SMS sucks.

"This is a discussion about passkeys."

No, that's not the way it went. I joined the conversation, such as it is, to respond to the guy who said "SMS is an ugly user experience" to say no, it's fine.

I haven't shifted any goalposts: I've basically just reiterated to you that I think it's fine and better than the alternatives. Not a word about passkeys from me.

"SMS is an ugly user experience"...compared to passkeys.

It's not fine that SMS messages get delays. It's not fine that it requires a cell phone plan. It's not fine that it requires you to have cell service. Its not fine because it's insecure.

So many times I've had coworkers and clients frustrated they are pushed to letting their employer force SMS 2FA on their personal numbers. When they could just use passkeys these days baked into their work machines and not have those problems.

Settle down. I responded to the statement "SMS is an ugly user experience and more importantly is expensive" to point out that from my perspective, neither one of those things is true. The "user experience" is fine and to me, the cost is zero.

Then you decided, for some unknown reason, to jump in and... do something, but I'm not sure what. Seems like you're trying to convince me that my own view of my own experience is wrong somehow but — and one might think this would be obvious, but apparently not to you — that's not gonna work.

Reply on news.ycombinator.com