News for hackers. Stuff that matters.
Re:Tell HN: SMS-based two-factor authentication is not secure by bun_at_work on Wednesday June 09, 2021 @11:50AM (#27449312)
What about an authentication app? Google Authenticator or something similar can be installed on the phone which is necessary for SMS, improves the security more than SMS, and doesn't suffer from the problem of losing it, at least not more than SMS auth does.
Re:Tell HN: SMS-based two-factor authentication is not secure by FabHK on Wednesday June 09, 2021 @01:49PM (#27450894)
When your phone is lost or stolen, you buy a new phone and go to your telco provider to get a new SIM with your number. SMS 2FA continues to work. Your Authenticator secrets are gone with the phone, and you're locked out.

(Unless you use a solution like Authy with multiple devices, which strikes me as the most sensible solution.)

Re:Tell HN: SMS-based two-factor authentication is not secure by filoleg on Wednesday June 09, 2021 @02:40PM (#27451472)
It blows my mind that Google Authenticator still doesn't have a multi-device sync feature (or even a "recover from backup" feature on iOS for that app, because I think they added it recently to Android; just "recover from backup" alone would have been sufficient to convince me not to switch).

All of that made me switch to Microsoft Authenticator, as they do have both multi-device sync and "recover from backup" feature as well, so now I don't need to be stressed about my phone getting lost. Kind of sad, given that I've been a user of Google Authenticator for quite many years until that point.