Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

I've done a piss poor job of describing it, but the way TOTP works is there is a "setup code" or a setup "string". Often in a QR code format.

That string is all that is needed to generate all of the TOTP codes forever. So while the TOTP code that you type is different every minute, it's generated by doing some math on the setup string and the current time.

Some password managers (like 1Password) allow you to have them generate your TOTP codes by putting in your setup string into them (often using the exact same process you would do to setup your TOTP codes in an app). But i'm saying that's not a good idea if you are going for "most secure", because at that point if something were to somehow exploit your password manager, they will not only get your username and password, but will have that setup string as well so they can generate their own TOTP codes for you.

Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is.

A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key.

SMS does not verify this and the factor is not something you have. Instead, SMS is more like "something loosely associated with you that is transferrable and vulnerable to social engineering attacks".

Anything is better than nothing. However this may be worse because it provides a false sense of security.

https://i.pinimg.com/originals/8d/6e/f3/8d6ef375e012df303faa...

The second factor for authentication is best handled by having it under the account holder's control. Either a client side TLS certificate or a Yubi key. The former is better in my opinion since it's compatible with application level protocols other than HTTP.

There is no universally accepted second factor.

* SMS (and automated voice call) are bad for people who live in areas with poor phone coverage, people with international phone numbers, and people who want good security.

* TOTP is bad for people who don't have smartphones.

* FIDO U2F is bad for people who don't have $20, safari/iOS users, and people whose devices don't have USB.

* Vendor-specific apps are bad for people who don't have smartphones, people with low spec or poorly supported smartphones, blind people, and the privacy-conscious.

* Smart card readers and physical tokens with screens cost $$$, often aren't accessible to blind people, and are too bulky for users to carry more than one or two.

* Paper single-use codes are bad for people who log in regularly, people who don't have printers, and don't scale to multiple services all that well.

* All of the above are bad for people who are forgetful or clumsy enough to regularly lose or break the second factor.

WITH THAT SAID, you can still provide Hacker-News-reader-approved two-factor authentication by basically copying Google: Offer the user TOTP, FIDO, SMS and paper codes, let them choose any two.

Gain bonus points with a setting that stops customer services resetting the password or disabling 2fa, and a week-long warning/waiting period in case account hijackers dial up the security settings to stop the original user getting their account back.

Please do not allow people to call SMS 2FA. For it to be 2FA, it must be: something I know alone, something I possess alone, something I am alone. Otherwise, it's just another account identifier (and likely spoof-able). SMS and phone numbers are none of these.

In same vein, I wish security questions would die in a fire. Always treat them like additional passwords: use nonsensical words and store them in your password manager.