News for hackers. Stuff that matters.

A comment on How do you handle 2FA?. Parent comment

Re:How do you handle 2FA? by PranavBerry on Tuesday October 26, 2021 @04:06PM (#29005592)
> If the user needs to be loggedin somewhere, they must be online

I will be using JWTs, with asymmetric signatures. An internet connection will only be needed while adding the device for 2FA. The JWT will be generated from the private key already on the phone so internet is not necessary.

[ Parent | on HN ]
Re:How do you handle 2FA? by chinathrow on Tuesday October 26, 2021 @04:28PM (#29005842)
What problem are you solving? I don't get it.
[ Parent | on HN ]
Re:How do you handle 2FA? by PranavBerry on Tuesday October 26, 2021 @04:48PM (#29006063)
If the phone not having a internet/network coverage was a problem, my idea could be useful. It also makes the phone a kind of hardware token, a user can login only if he has his phone.

However from the responses it looks like this is not an issue and I'll probably not work further on this idea.

[ Parent | on HN ]
Re:How do you handle 2FA? by chinathrow on Wednesday October 27, 2021 @03:46AM (#29010584)
Yeah I really think it's a non-issue: 2FA apps such as Authy or Google Authenticator already work if the phone is offline.
[ Parent | on HN ]