Why Hasn't Hacker News Implemented TOTP for 2FA Yet?

1 pointsmbix771y ago4 comments

Hey HN,

Been thinking about account security and noticed that Hacker News still doesn't offer any form of 2FA (Two-Factor Authentication). Given the tech-savvy community here, it seems surprising that we don't have this extra layer of security.

TOTP (Time-based One-Time Password) would be a great option to start with, considering its balance of security and convenience.

So, I'm curious:

    * What's the hold-up with implementing 2FA, specifically TOTP? Any technical hurdles or other considerations?
    * How important is 2FA to the HN community?

Seems like a no-brainer to add 2FA and beef up our account security. Thoughts?

4 comments

freediver1y ago

Low stakes and friendly moderators you can email in case of trouble?

almosthere1y ago

what is being "secured". Is there a hacker news bank I don't know about?

anenefan1y ago

Any forum type site that needs one time passwords or 2FA is obviously too secretive an area for the like of myself to be posting.

LinuxBender1y ago

I would honestly expect the HN crowd to be using long complex passwords. That's probably sufficient for this type of site. I guess only dang could say if HN has been having challenges with account take-overs. I never hear about it. I would not mind having the option to restrict my login to a CIDR block however. I am personally not a fan of adding third party authentication unless it is entirely self hosted and the code is reviewed by teams like NCC.

For banks and some DNS registrars I use IP restrictions in addition to whatever 2FA usually SMS they support along with challenge questions. Additionally for banks I make most of my accounts read-only from the internet. IP restrictions are a feature their support team dislike as many people think they have a static IP when they do not.

j / k navigate · click thread line to collapse