Hacker News new | past | comments | ask | show | jobs | submit login

No security system is absolute, and treating all threats as equally possible leads to terrible security decisions like not using printed recovery codes for fear of them getting stolen. You must pick a threat model before you can evaluate the security of a system.

Treating printed paper codes as "widely known" and effectively useless simply because they could theoretically be stolen is silly. In a reasonable threat model for almost all people, the intersection of the set of threats that might get access to printed paper codes and the set of threats that might hack/phish your password is very small. The vast majority of threats are still protected against, while the very real possibility of being locked out of your account is drastically reduced. It's a good trade for almost everyone.




I don't disagree with this, I disagree with the way you formulated it initially. There's a difference between sharing recovery codes with 2-3 trusted people vs. posting them literally everywhere which your original post seemed to imply.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: