News for hackers. Stuff that matters.

A comment on Google Authenticator now supports Google Account synchronization. Parent comment

Re:Google Authenticator now supports Google Account synchron... by kotatsuyaki on Monday April 24, 2023 @09:51PM (#35695653)
GitHub has a similar problem, where the GitHub mobile app can’t be disabled as an 2FA factor. They implemented an option to make other factors as the “default” without the ability to completely disable mobile, and then falsely closed the discussion [1].

If such insecure factor can’t be disabled, what’s the point in setting up TOTP and / or hardware keys?

[1]: https://github.com/orgs/community/discussions/10861

[ Parent | on HN ]
Re:Google Authenticator now supports Google Account synchron... by bombcar on Monday April 24, 2023 @09:53PM (#35695669)
The point is to offload security faults onto the customers so tickets can be ignored.
[ Parent | on HN ]