Yep. Binding 2FA flows to email is risky business for a lot of reasons, but regi... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

ryukoposting 80 days ago | parent | context | favorite | on: GoDaddy gave a domain to a stranger without any do...

Yep. Binding 2FA flows to email is risky business for a lot of reasons, but registrar incompetence might be the spookiest thing of all.

miladyincontrol 80 days ago [–]

Same reason I dislike SMS based 2FA, or worse SMS/email based 1FA codes.

You dont truly own your cell number or domain. Meanwhile passkeys are certainly hardware I own, likewise my TOTP codes are stored and calculated locally.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact