Re:Design flaws of password managers
by dheera on Sunday January 03, 2021 @01:53AM
(#25620095)
Real 2FA with at least 2 hardware keys is good. Shitty SMS 2FA is no good, hardware key + SMS is no good.
The big advantage to a hardware key is that if someone snatches it from you, you can go home, log in with your backup key, and disable the stolen key.
Phone-based 2FA is super vulnerable to simple phone theft, SIM swapping, phone number porting theft, and it's simply ridiculous that if you carry a laptop with you that you also need a phone. The laptop itself should be able to accomplish everything. I believe in the most powerful device in front of you should handle 100% of digital tasks including 2FA.
The big advantage to a hardware key is that if someone snatches it from you, you can go home, log in with your backup key, and disable the stolen key.
Phone-based 2FA is super vulnerable to simple phone theft, SIM swapping, phone number porting theft, and it's simply ridiculous that if you carry a laptop with you that you also need a phone. The laptop itself should be able to accomplish everything. I believe in the most powerful device in front of you should handle 100% of digital tasks including 2FA.