News for hackers. Stuff that matters.

A comment on Tell HN: SMS-based two-factor authentication is not secure. Parent comment

Re:Tell HN: SMS-based two-factor authentication is not secure by StavrosK on Wednesday June 09, 2021 @09:40AM (#27447705)
> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe

Not only that, but you can remove the username too: WebAuthn supports a "usernameless" mode where you press "login", touch your authenticator and you're in.

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by withinboredom on Wednesday June 09, 2021 @12:44PM (#27450075)
But that isn’t portable. If you lose your device or just reinstall the OS, you can never login again.
[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by StavrosK on Wednesday June 09, 2021 @12:51PM (#27450180)
Sure, but that's why you add multiple devices/keys to your account. Reinstalling the OS should be fine.

I'm very much looking forward to password managers acting as soft-WebAuthn tokens so they can hold a simple private key and log you in to sites automatically by answering the login request. That way, you only need to unlock your password manager and you can log in to any site without a u/p.

Just don't get your password manager stolen, I guess, but that's already the case.

[ Parent | on HN ]