Hacker News new | ask | show | jobs
by kbar13 394 days ago
i worked on a large platform (YC company, too!) previously on their 2FA implementation. while not ideal, it was decided to keep SMS 2FA because there are still people out there without smart phones or in general the ability to do TOTP. but they still have some means to access the site that wasn't a smartphone i guess.

so, it's a bit of a compatibility issue, i guess there will be some portion of the population who will be very upset that they need to buy a whole new smartphone just to securely access their banking details
2 comments
creer 394 days ago
Anything that requires a cellphone bakes in BOTH a single point of failure and cumbersome extra steps. Terrible practice anyway - even though so many people here are in love with both single points of failure and extra steps.

ALLOWING methods X, Y or Z would be better reasoning.

link
ted_dunning 394 days ago
That isn't a very strong argument for not allowing me to secure my account.
link