Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I can't really see this as the negative you imply it to be. This seems like complaining that you might get locked out of your house if you lose your keys. There are certainly better and worse forms of 2FA, but I would like more pervasive (well-implemented) account security, not less.


The main key is the password, and we didn't lose the password. What we lost is the secondary, rarely-used-key that you only need when logging in on a new device or at new location. So if you don't leave home much, it's easy to forget that your online account access is totally screwed without your phone anywhere else. My wife's Google account doesn't require TOTP to login, so she never needs her phone when logging in at home, yet the phone is mandatory when logging in for the first time on a new device or at a new place. This creates catch-22 situations for people unaware of this behavior like it did for us ("we need to login to find the phone but we need the phone to login").

We learned our lesson, but I'm sure there are tons of other people that haven't learned this the hard way yet (but will eventually). I could see this becoming an easy way to sabotage/get revenge on people - steal their phone while they are on a business trip/vacation and then they are locked out of all their online accounts with no way in unless they had the foresight to keep physical copies of backup codes in their wallet/purse.


A better analogy would be the locksmith refusing to let you in because you can’t produce the deed, which itself is in the house.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: