Hacker Read

cbsmith | karma 4783 | avg karma 1.38 · 2021-09-13 15:00:38

The never allowing multiple tokens things drives me nuts.

tialaramex | karma 26322 | avg karma 2.85 · 2021-09-13 17:02:35

People do bring this up on HN a lot. For WebAuthn / U2F the only actual example anybody has is AWS. So that's not an industry problem that's specifically an AWS problem. Unless you have an actual example which isn't AWS?

As to TOTP it's a shared secret, so just clone it. If they allow you to set multiple secrets it would just reduce your overall security because more random guesses work. Also, get WebAuthn instead.

reply

cbsmith | karma 4783 | avg karma 1.38 · 2021-09-16 14:42:28

Try setting up multiple WebAuthn w/Facebook, and then disabling the phone based back door.