Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> you can't use MFA authentication on Twitter without giving them your phone number.

GitHub also require MFA authentication since this year.

Does it mean that any MFA authentication now has same leaks?



No. But you should be concerned if you choose to give your phone number to people, because if they know it they might leak it through any combination of malice or incompetence.

Other than my banks, none of the systems I've enabled MFA for required a telephone number.

That includes: Dropbox, GitHub, Slack, Facebook, Nintendo, Google, Login.gov and the Digidentity.eu variant of Gov.uk Verify.

Everywhere it was possible I used my FIDO Security Keys which are phishing proof, impractical to de-anonymise and foolproof because the site has no secrets to leak. Whenever I hear that a site I already used MFA for gained WebAuthn or U2F I go back and switch that site to Security Keys.

Everywhere else I used TOTP (Google Authenticator) which can be phished using a live proxy and the site could leak their copy of your TOTP secret (not the changing code, but the secret that drives it) but other than those two concerns it's pretty safe. At least nobody can work out your real world identity by knowing your TOTP secrets.


Not unless the service requires a phone number in order to enable MFA. Some providers require the phone number for "recovery" purposes once MFA is enabled very much defeating the usefulness. Countless times we've heard of a helpful AT&T / T-Mobile / Verizon employee forwarding texts or generating a new SIM card for a scammer with a fake ID. It's just too easy.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: