Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Lets try the same logic everywhere else.

The difference between SMS 2FA and the examples you mentioned is that the former is literally impossible to use securely because there is (AFAICT) no (American) consumer mobile provider that implements proper safeguards against unauthorized SIM swaps and similar. Any company implementing SMS 2FA ought to know this, and any company knowingly implementing a deeply flawed 2FA system and selling it to consumers as "more secure" ought to be held liable when it fails. And the sooner SMS 2FA dies, the sooner the same old websites that implement SMS 2FA and nothing else will be forced to implement something that's actually secure.



Unfortunately, there are already laws that demand sms auth, e.g. online gambling in some US states (new jersey, being one).

The persevere practice has been established as 'strong login'.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: