Hacker News new | past | comments | ask | show | jobs | submit login

The problem is what do you do about 2fa which more and more organizations are requiring almost always via sms ? I suppose yubikeys could be part of the solution of getting away from the phone for auth.



I don't see an issue with SMS 2FA. You can just move the sim card if your phone breaks and also it works without special smartphones. That being said I don't really see SMS 2FA in use that often (I live and work in the UK).

I've also not seen a massive push for 2FA which requires a special mobile-only application from organizations. Aside from my bank, where I have the option of a mobile app or a small calculator-looking token (I obviously picked the token), most 2FA I see is basic TOTP (which you can back up and treat as you like) or some third party solution which provides non-mobile options (and half the time someone has reverse engineered the software and there's an open source solution or it's actually just generic TOTP which you can run anywhere).

My work relies on a VPN connection and the the token is generated in a special mobile app, they have given me a smarphone for this purpose. I was informed by coworkers that if you reset the token and re-generate the key you can load the key into a slightly modified version of any TOTP program which uses a slightly different interval and it would work. But at the end of the day if my job requires this token and they give me a phone for it and that's the only source of the token and the phone breaks, I'm not going to really fret about it. It's not my problem to solve, all I have to do is contact my employer and get them to sort out getting me a new phone and getting me back up and running. Keeping this backed up is not my responsibility.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: