Re:Show HN: A virtual Yubikey device for 2FA/WebAuthN
by smeej on Saturday September 17, 2022 @07:39PM
(#32882753)
I think my favorite example of using SMS in the least sane way possible is PayPal.
I have a hardware key AND an authenticator app active for the account, but they STILL won't let me send transactions without entering a code sent to my phone number. And actually, not even then, because even though I receive the code fine, they say they can't authenticate me and don't give me a chance to enter it. Yes, it's a VOIP number, but it's been the same VOIP number for the 10 years I've had the account. It's not like it's new.
Re:Show HN: A virtual Yubikey device for 2FA/WebAuthN
by bb88 on Saturday September 17, 2022 @08:03PM
(#32882927)
I needed to recover my user account / password through Voya recently for a corporate 401k.
They needed to send me 3(!) SMS messages in the process. One to get the username (with a valid email address). One more to request to change the password. And one more to actually change the password.
Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.