Ask HN: Why did smartphones become a single point of failure?

Re:Ask HN: Why did smartphones become a single point of fail... by vladvasiliu on Tuesday August 09, 2022 @09:06AM (#32397257)

The issue is that some services insist on using their own app as a second factor. You can't choose to use a superior U2F YubiKey, for example. You are also not allowed to have their shitty app installed on multiple phones at the same time. If you lose your phone, you need to call them up to reset this.

To name and shame: BNP Paribas, one of the biggest banks in France.

[ Parent | on HN ]

Re:Ask HN: Why did smartphones become a single point of fail... by Double_a_92 on Tuesday August 09, 2022 @09:30AM (#32397568)

> you need to call them up to reset this

My bank sent me a super key (some colorful QR code) to setup new 2FA devices, which I need to securely store somewhere.

[ Parent | on HN ]

Re:Ask HN: Why did smartphones become a single point of fail... by cube00 on Tuesday August 09, 2022 @09:34AM (#32397626)

It's interesting that a super key even exists. Normally the enrolment QR codes are one time use only.

[ Parent | on HN ]

Re:Ask HN: Why did smartphones become a single point of fail... by gunapologist99 on Tuesday August 09, 2022 @05:44PM (#32404747)

This is incorrect.

A standard TOTP QR code can be used on multiple devices or saved and printed (and stored in a safe or something). There is no expiration date encoded in the QR; it is simply the shared secret for the TOTP app to use and some extra metadata like labels. See https://www.rfc-editor.org/rfc/rfc6238

It is a good idea to enroll multiple devices as a backup against failure, or to store it somewhere safe.

[ Parent | on HN ]