Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Isn't that the point of having backup codes for Google, etc.? I can use those to restore my account, and secure them however I like.

Backing up the secrets to a third party makes them vulnerable to anyone who can hack your Authy account. I'm not sure what that requires, possibly hacking a phone number. Of course, there's also a backup password, but then you're just replacing the "physical" factor in 2FA with another password.

Without Authy, to compromise my account, you need physical access to my phone, my backup codes, or another backup mechanism I've specified. Authy just provides an additional way to compromise my account, and I don't think it provides any real benefit in exchange for that risk.



Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: