Hacker News Reader

Comment by mpyne | Hacker News Reader

It's possible to have computer Internet connectivity in an area with no cell phone reception. I go to a place like that about once a year at least, or so.

View on HN

I thought his is one of the reasons they have backup keys which you can use when your phone is not reachable. I haven't actually tested the new system though.

Maybe they are trying to tell you to stop tweeting about it, put down your phone and enjoy your vacation?

I appreciate the sentiment but let's be real, what problem did they solve exactly?

Twitter? They solved the insecurity and instability in using their previous SMS solution, and they don't hold the key to the second factor of authorization, in the event their systems leak.

I don't think they can be, as I don't have a Twitter account.

Certainly I would be pissed beyond belief if I tried to login to my bank (assuming they ever pull their heads out of their asses to support 2FA) and couldn't because I don't have cellular service in addition to Internet.

I already have this problem; both my bank and my credit union introduced 2FA but only with SMS. Once enabled, any attempt to log in using a not-yet-authorized browser or app is stalled until I get that text message. Presumably a call to customer service would sort it out eventually, but that prospect isn't terribly pleasant.

Every time I have to call customer support to reset a bank password it makes me realize how bad of a security hole most phone support is. Security through two-factor authentication is only as strong as the process for bypassing it.

Once a year? Store your backup S/KEY under your favorite keyring.

Reply on news.ycombinator.com