Hacker News new | ask | show | jobs
by ShakataGaNai 1723 days ago
Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape.

This is much nicer looking. But... and it's a very big but... why would you trust this service? You're giving random person on the internet your 2FA secret keys. Their TOS & PP don't even mention encryption. I'm not saying you can't do something like this, but I'd be extremely hesitant using something for a very high security purpose that is probably done by one person as an MVP.

There are other options, 1Password and LastPass both support 2FA TOTP codes. If you trust those, they are "better" for security. Do they have some of the features and convenience of this service? No. But at least you already trust them for high-security usage.

2 comments

Of the two 1password for teams is much better, the user interface on LastPass Enterprise is this horrid monstrosity that keeps flipping you between web pages and a native interface for basic account maintenance. 2FA required a separate client altogether though they might have integrated it just as I was saying goodbye. In 1password it is seamless.
Not just that... you're also sending those 2FA codes through yet another third party service (Slack), so you have two places where your security can be compromised.