Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I really don't have anything to say to the OP, but I wonder(in a similar situation) if with the recent push towards e-sim, will SMS based 2FA become more problematic?

If a phone with an e-sim dies, and you need some kind of OTP, I wonder how you'll receive it. You can't exactly 'transplant' the SIM into another phone.



SMS 2FA is just a terrible idea. I advise anyone to use something like TOTP but also to store the TOTP seed as well as recovery codes in e.g. a KeePass database.

You may use a different database than the one with the rest of your passwords. Sync these databases with something like Syncthing, which is completely controlled by you, can do untrusted encrypted nodes and can not only sync but also take occasional backups for you.

Also don't forget to put the master password of your KeePass databases into someone elses database. Someone you trust in person, e.g. a family member.

It may be a quite complicated setup, but once its set up, it works and not much effort to maintain it is required. If you get a new device simply add a new syncthing node.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: