Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

U2F and HOTP (Google Authenticator style 2FA) are not mutually exclusive.

I have both enabled on the sites that support both.

I use U2F when I have the key near me, and use HOTP on my phone otherwise (like you, my phone is typically closer to me than my U2F key).

A common response at this point goes "But then doesn't introducing HOTP remove the security benefits of U2F?" No. One of the main benefits of U2F is that it is phish-proof: the U2F key cryptographically authenticates the server, rather than the user eyeballing the address bar, which is how server "authentication" works with HOTP.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: