Ask HN: 2FA Contingency During Phone Service Outage

Posted by Zaheer on Monday June 15, 2020 @09:36PM
from the ask-hn dept.

Several sites use text message as 2nd Factor Authentication. Given the ongoing service outages (https://techcrunch.com/2020/06/15/t-mobile-calling-outage/) what other alternatives do we have when phone service is down? I was unable to access my bank account today because I never received the 2FA code via text. Although I had no critical tasks this seems ripe for havoc.

( 3 comments | 2 points | on HN )

Re:Ask HN: 2FA Contingency During Phone Service Outage by bradknowles on Monday June 15, 2020 @09:57PM (#23535204)

Ideally, use a hardware token instead. They implement many different algorithms, so you should be able to find one that does what you need with your bank. See https://www.zdnet.com/article/best-security-keys/ for one good list.

Alternatively, there are TOTP apps you can get for your mobile device. See https://www.nytimes.com/wirecutter/reviews/best-two-factor-a...

[ Parent | on HN ]

Re:Ask HN: 2FA Contingency During Phone Service Outage by gamell on Monday June 15, 2020 @10:32PM (#23535411)

this, also in general SMS authentication is known to be insecure anyways.

[ Parent | on HN ]

Re:Ask HN: 2FA Contingency During Phone Service Outage by phillipseamore on Tuesday June 16, 2020 @10:59AM (#23539899)

No one should rely on SMS for 2FA! Phone numbers are bad authentication tokens (they can change hands, be diverted etc).

Proper 2FA should either be TOTP codes and apps for those or hardware tokens. Any of these should also have backup codes.

[ Parent | on HN ]