Why is using SMS bad for 2FA?

Re:Why is using SMS bad for 2FA? by Rafert on Wednesday November 17, 2021 @12:09PM (#29255715)

You might want to look into what the FIDO Alliance is doing with WebAuthn. The problem is already being solved.

[ Parent | on HN ]

Re:Why is using SMS bad for 2FA? by PranavBerry on Wednesday November 17, 2021 @02:08PM (#29257442)

> FIDO Alliance is doing with WebAuthn

Yes I looked into it, but it looks like WebAuthn does not support multiple devices (let me know if I am wrong).

What if I want to login from two different devices? I don't think that is possible with WebAuthn, but using my authenticator you can login to multiple devices. You will also be able to add a recovery email address to my authenticator to recover your accounts if you phone gets damaged/lost.

[ Parent | on HN ]

Re:Why is using SMS bad for 2FA? by ViViDboarder on Wednesday November 17, 2021 @02:55PM (#29258090)

Yes it is. I can plug my Yubikey into as many laptops as I would like.

> You will also be able to add a recovery email address to my authenticator to recover your accounts if you phone gets damaged/lost.

This worries me. That means I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy. All my 2FA is on my Yubikey.

[ Parent | on HN ]

Re:Why is using SMS bad for 2FA? by PranavBerry on Wednesday November 17, 2021 @03:12PM (#29258265)

> plug my Yubikey into as many laptops as I would like.

What if you don't own a physical key?

> I have to trust you to not leak my 2FA. Authy does this already and so I don’t use Authy

This is optional. You can choose not to have a recovery email. Just curious though, what do you do if your Yubikey gets stolen/damaged/lost?

[ Parent | on HN ]

Re:Why is using SMS bad for 2FA? by ViViDboarder on Saturday November 27, 2021 @11:46PM (#29366234)

I have a backup Yubikey as well as backup codes stored in an encrypted file and backed up to several different devices.

[ Parent | on HN ]