Hacker News Reader

Comment by Zikes | Hacker News Reader

They keep saying this is 2-factor authentication, but without the first factor (something you know e.g. a password) and going straight to the second factor (something you have e.g. your smartphone) they actually only provide a single factor for authentication.

This is of course less secure than true 2-factor authentication, and the web site is misleading in its wording.

View on HN

> They keep saying this is 2-factor authentication, but without the first factor (something you know e.g. a password)

I always wonder about this even when there is a password. For most services, a phone compromise would be a total compromise. I rarely get prompted for a password on my phone (nor do I enjoy typing one when I'm trying to do something quickly.)

Well if you choose two-factor by sending the code to your SMS and your device is lost it is certainly doom. Just as if you lose your laptop there is a great chance someone with enough patient and skill can/may hack into an encrypted disk/brute force the login.

To be fair if your phone is locked with a pin then we're still at least roughly in "something you have and something you know" territory.

Very roughly. When you put in your phone lock pin, you are not authenticating with the website. So roughly, it's not.

I dont see how that matters. You still need a password + one file (on the phone). SSH keys with passphrase are two factors as well in my book. In fact, I would say that not having to transmit the weakest part (the mnemonic password/pin) over the wire is a plus.

I dont see how that matters.

Please tell that to anyone thinking of hiring you for security.

I asked this exact question to the team on Twitter a few days ago when I first heard about this. Their response[1] was that you need a PIN to unlock the app.

[1] https://twitter.com/getclef/status/431095300619390976

No matter how well protected the phone or app is, the receiving service still only gets one factor of authentication.

PIN is short (usually). Which means if somebody gets their hands on your phone, they need to only guess about 13 bits of information (for 4-digit PIN) to get access to every site you ever logged in with this phone. That provided they actually use the PIN to encrypt the data, not just to check access to it, in which case once somebody gets their hands on the phone, it's game over.

Reply on news.ycombinator.com