Re:Jack Dorsey’s account was hacked
by rtempaccount1 on Friday August 30, 2019 @06:22PM
(#20843254)
Hopefully if that's the case, more attention will be paid to the fact that using mobile phones for 2FA or identification on high value services is a bad idea :)
[ Parent
| on HN ]
Using phones is fine, using phone numbers is the problem. TOTP is great
Re:Jack Dorsey’s account was hacked
by tomatocracy on Friday August 30, 2019 @06:41PM
(#20843384)
Until the authenticator app which holds the TOTP secrets in clear text is on the same phone as you are using to access the website/app in question to start with. Then you'd probably be better off instead storing a token in the secure enclave in the app itself instead.
I don't understand why people do that. Your 2nd authentication factor should not be something relying on the same device that you're using.
Re:Jack Dorsey’s account was hacked
by roywiggins on Friday August 30, 2019 @11:27PM
(#20844461)
It reduces the set of people who can access your account from "people with the password" to "people with the password and access to my phone."
It's less like a 2nd factor and more like a poor man's password-protected private key authentication, but it's way better than just a password.