Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They (and similar corporate 2FA solutions like PingID and similar systems used by banks) basically assume uninterrupted access to the internet which is generally a poor assumption. It often breaks down when you're traveling either due to network or roaming issues just when you desperately need access.

In all these situations, I've found companies which offer a back up SMS option very valuable since it usually gets delivered.



I'm pretty sure the Microsoft authenticator has a backup TOTP token you can have it display if you have issues receiving the notification. It is quite a user friendly auth scheme, at least I've never had to resort to any kind of SMS backed auth.


In my opinion, that sounds like precisely the sort of system that should not offer an SMS fallback unless the goal is to create a false sense of security in the user. But YMMV, I don't generally need to access my online banking applications when I don't have useful internet access.

I tend to use TOTP for systems where I'm concerned about offline usage. But again, YMMV.


Yeah, and my local walmart has a section where there is no network coverage; I was browsing the store and wanted to check something on my bank app; it prompted me for SMS code, which I didn't receive because of no network; & I would not have received the Google prompt if I needed one for the same reason.


HOTP-based 2FA systems (like Google Authenticator) do not require internet connections.


Don't most folks uses TOTP-based schemes with Google Authenticator?

Unless you're using HOTP to mean HOTP and all extending schemes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: