Hacker News new | past | comments | ask | show | jobs | submit login

Not just that, it's a bad solution to the problem it's attempting to solve. (What if your password manager gets compromised?) To have that problem, someone must both have your password manager database and the master password and/or keys to unlock it. Since you need your password manager on your phone, the assumption that having your phone somehow provides an additional factor over having your password manager is just plain wrong from the beginning. 2FA as implemented isn't even a second factor.

And, as others have mentioned, it increases the likelihood of getting locked out of your accounts (if you don't have your phone with you or the battery died or whatever). Which encourages service providers to make account recovery easier (it needs to be easier if people are more likely to get locked out.) And making account recovery easier makes it easier for other people to 'recover' your account.

3rd-party authentication (other people vouching that you are who you say you are) might be better, but would have its own problems.

In the end, the real solution to the problem of 'what if your password manager gets compromised?' is to minimize that possibility by _not_ having it online, having really strong master password and/or keys, and avoiding malware. 2FA doesn't help with that at all. It just adds its own problems.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: