TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Why did smartphones become a single point of failure?

238 点作者 neverminder将近 3 年前
i can't log in to any of my banks without my phone. Most of the systems in my workplace also require phone app authentication. I can't do any of those things with just a PC or laptop. Smartphones being the smallest and portable are surely the most lost and stolen. If someone got a hold of my PC or laptop - they would be able to do some damage, but not even close to if they were able to access my phone. Everything everywhere nowadays requires some app.

52 条评论

dogleash将近 3 年前
Nobody knows how to do a failure analysis. I used to work in r&amp;d, now that I’m building websites and mobile apps the culture doesn’t care. Pointing out obvious design limitations will, more often that not, make me the asshole.<p>Not even trying to delay ship or get future rework scheduled, just having it documented is too much. Out of sight out of mind.
评论 #32397352 未加载
评论 #32397668 未加载
评论 #32397343 未加载
评论 #32399353 未加载
评论 #32398349 未加载
winternett将近 3 年前
Your phone is leveraged so much because it provides companies with deeper tracking capabilities. Most laptops and PCs only geo locate based on their connection points, phones have accelerometers and more accurate location and ID info in them, so many app makers hobble browser-based app iterations to encourage mostly phone use. They also know users are engaged and focused on content more when they are on phones because browsing in multiple tabs is less possible than on desktop PCs. It&#x27;s ridiculous that we are manipulated in this way, but fandom for certain devices and apps has created powerful companies that dictate how the Internet works, rather than a better world where companies work to provide value and function to consumers first. The customer is no longer right, whatever the company dictates is what is right now, unfortunately so for us.
评论 #32399011 未加载
评论 #32401667 未加载
评论 #32399475 未加载
nicbou将近 3 年前
This is a big problem for me as a traveller. If I travel long distance and I lose my phone, I lose access to both my personal and business bank.<p>I once dropped my phone in a lake (I&#x27;m clumsy) and was locked out of most things for a few weeks.<p>I prefer TOTP for most things. Keepass supports them across platforms, but Aegis has a better experience on mobiles.
评论 #32398296 未加载
评论 #32398483 未加载
评论 #32401178 未加载
评论 #32408216 未加载
评论 #32399505 未加载
评论 #32397689 未加载
评论 #32397359 未加载
theonemind将近 3 年前
I didn&#x27;t have a cell phone until work issued me one around 2018 or so. (I never really liked the idea.) Generally, I don&#x27;t have many single points of failure tied to the phone not tied to work...certainly nothing related to my banking.<p>You can still live in 2022 without one, although the assumption that you have one gets more annoyingly entrenched year-by-year.<p>I don&#x27;t quite know what these single points of failure are, but they must tend not to exist when you have a &quot;hard no--I have no such device&quot; in your back pocket...you can choose services that don&#x27;t require it, use hardware token 2FA, or something. Somehow, it <i>does</i> still work out to simply not have one, but it seems hard to avoid reliance on it once you&#x27;ve got it, since you don&#x27;t see a service and think &quot;well, I guess I just can&#x27;t sign up for that one&quot;, but instead whip out the cell phone and comply.
评论 #32399225 未加载
评论 #32403224 未加载
评论 #32399207 未加载
dsr_将近 3 年前
Go through the whole list and figure out which of these services really requires your phone, and which you have set up on your phone because that seemed the easiest path.<p>Tell your workplace you&#x27;re about to switch from carrying a phone to a landline: what is their fallback option? (It&#x27;s about 50&#x2F;50 whether they have one, but they definitely should.)
评论 #32397387 未加载
评论 #32397596 未加载
评论 #32397801 未加载
评论 #32397053 未加载
评论 #32397319 未加载
评论 #32396994 未加载
评论 #32408142 未加载
评论 #32397104 未加载
jasode将近 3 年前
<i>&gt;i can&#x27;t log in to any of my banks without my phone. </i><p>Don&#x27;t know about banks in Europe but in USA, I can log into Bank Of America and JP Morgan Chase without any phone authentication.<p>If I reformat my harddrive or buy a new computer and the bank doesn&#x27;t recognize the web browser because no previous cookie has been found, the website will generate a one-time code and send it to my email address. I then enter that security code and the web browser is &quot;recognized&quot; without further issue. The smartphone was not needed in any step.<p>EDIT ADD: I did open my bank accounts before 2007 and thus before the smartphone era. Because of that, there may be a possibility that my logins are &quot;grandfathered in&quot; to not require any smartphone app authentication. It&#x27;s possible that <i>opening new accounts</i> today with BofA&#x2F;Chase require smartphones but somebody else would have to confirm&#x2F;deny that.
评论 #32396990 未加载
评论 #32396855 未加载
评论 #32397278 未加载
评论 #32396869 未加载
评论 #32397718 未加载
评论 #32398409 未加载
评论 #32396879 未加载
kome将近 3 年前
Indeed it&#x27;s incredibly stupid development. Fuck smartphones, really. I don&#x27;t own one and I feel happy overall, but life is complicated because nowadays some sort of stupid app is required (most of the time, for no good reason) and dealing with those requirements always cost so much thinking.<p>I don&#x27;t want a micro-computer in my pocket, I stay at the computer all day anyway, a better one.<p>Why can&#x27;t I do with a real computer what it is possible to be done with a phone?<p>A smartphone is just a tracking device, and it is terrible for privacy - but great for advertisers and similar industries.<p>Otherwise, a computer should be able to do everything a smartphone does.
评论 #32397025 未加载
评论 #32396993 未加载
评论 #32397710 未加载
megraf将近 3 年前
I don&#x27;t have the same view, in my mind you have created a single point of failure for _yourself_. I use Authy for MFA, which comes with a desktop app. Phones dead &#x2F; missing? No problem, I can get OTP&#x27;s from my laptop.<p>What about text messages? Google voice. Which of course has a desktop interface. I&#x27;ve been doing this for years. It&#x27;s nice not to have to rely on a watch, or phone entirely - although they do make my life easier.
评论 #32397480 未加载
评论 #32397257 未加载
评论 #32397253 未加载
评论 #32398835 未加载
评论 #32401288 未加载
评论 #32399565 未加载
评论 #32397956 未加载
评论 #32398053 未加载
lotsofpulp将近 3 年前
Because using phone numbers to decide if human or bot is cheap, easy, and effective.<p>Politically, there is no will for a national identity verification type service as infrastructure. And this way, all the work gets outsourced to ATT&#x2F;Verizon&#x2F;T-Mobile, and politicians get to say “it is not our fault” and telecoms get to say “it is not our job”.
评论 #32396860 未加载
评论 #32398426 未加载
评论 #32396884 未加载
评论 #32397103 未加载
beebeepka将近 3 年前
I hate it. They have been phasing out web for years in the EU.<p>Banks mostly but these days employers too. Getting a separate device, or multiple, seems like the least horrible options to me.<p>Turns out everyone wants a piece of my data I in the name of convenience. Only, it&#x27;s their convenience, not mine.
评论 #32397008 未加载
sybercecurity将近 3 年前
Probably because I&#x27;ve heard the statement: &quot;Everyone has a smartphone these days, so...&quot; for the description of every app you describe. It makes some sense: single purpose devices for authentication tend to be set aside and misplaced. So it&#x27;s the union of ubiquity and ease of use.
_int3_将近 3 年前
Someone , somewhere decided: your digital life is going to be tracked and recorded to 3rd party cloud. (We are increasingly getting to that point) To accomplish that you were given central device ( a smartphone ) on which you ought to do everything related to your digital life. So how to remedy this? Easy, just don&#x27;t do that.
pessimizer将近 3 年前
Because they&#x27;re the thing in your life that you have the least control over. Businesses and governments can lower all kinds of costs by using your phone to manage you. If kings had the ability to distribute smartphones when feudalism was in full swing, feudalism never would have ended.<p>They watch you while you watch them, and there&#x27;s nothing you can do about it. What I really wonder is whether we&#x27;re 10 years away from police being dispatched if your phone is turned off (which, of course, would have started as opt-in, and ended as getting a ticket for letting your battery die), if we&#x27;re 50 years away, or if there will be some sort of Butlerian Jihad before it happens.<p>edit: we can pretend this is just about authentication, but the reason smartphones work for authentication is because you have no control over them. If you root your phone, it becomes useless for authentication.
BLKNSLVR将近 3 年前
I always have a backup Android device setup as per my standard operating environment for this very reason. I&#x27;m actually due to setup another one as my previous backup went to my daughter for her birthday recently (but it still has my SOE hidden on it).<p>But also, I don&#x27;t use my phone for banking because I still don&#x27;t trust mobile ecosystems. I use a dedicated VM that requires a decryption password to boot up.<p>But yeah, banks are pushing for app usage rather than web interface, which is ironic given that my bank still only has SMS 2FA, not token-based. So why would I trust their app to be anywhere near secure in an insecure ecosystem if they can&#x27;t even support proper multi-factor authentication that&#x27;s been standard for, what, 5 years already?
jesprenj将近 3 年前
I had a similar problem very recently with OVH. Though it&#x27;s not related to smartphones.<p>I migrated my personal domain (nameserver and email) to a different IP address. After migrating the server, I wanted to change the glue record on OVH.ie. They detected some suspicious activity and prompted me to enter the code that was sent to my email, email on the domain that has unreachable namesevers because I couldn&#x27;t log in to their dashboard. I had no 2FA enabled.<p>The interesting part about this is that I knew it might cause problems, so I also added a secondary email address to OVH, the one from our national academic research network. But OVH only sends codes to the primary mail! How useful ...
评论 #32401409 未加载
alsobrsp将近 3 年前
All my OTPs are in Bitwarden and FreeOTP.<p>The only thing I currently need my phone for is Google&#x27;s new device login and even that goes to my tablet too.
评论 #32396987 未加载
RockyMcNuts将近 3 年前
it&#x27;s crazy when museums don&#x27;t give out paper maps and expect you to use your smartphone - <a href="https:&#x2F;&#x2F;twitter.com&#x2F;austinkleon&#x2F;status&#x2F;1556466475354963968" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;austinkleon&#x2F;status&#x2F;1556466475354963968</a><p>there are old folks who aren&#x27;t that tech-savvy, and smartphones + plans are not that cheap or free in the US, we still have some extreme poverty, penetration is not 100%, if you&#x27;re going to make smartphone a requirement to participate in society there really need to be super-cheap smartphone options.
评论 #32499348 未加载
评论 #32398675 未加载
eternityforest将近 3 年前
They&#x27;re more reliable than any other affordable device capable of filling thr &quot;Your whole life in a box, I&#x27;ve ever seen, at least subjectively.<p>Nearly no moving parts(The few remaining ones seem to be the #1 failure mode), a general purpose OS that&#x27;s truly designed for what it does, etc.<p>On top of that, they have some built in safety features like the ability to remotely disable, wipe, and track them, plus, normal bank transactions can be reversed. I would much rather have a phone-linked account than go back to cash, and people used to carry that all the time.<p>Plus, for all the horror screen addiction causes, it does make losing your phone less likely, because you notice fast.<p>And on top of that, we used to (and still do) have MANY single points of failure ranging from debit card to notebook with meeting notes that could get you fired if you lose it to cash to house keys, any individual one of which could, if lost at the wrong time, cause a similar scale of damage to a lost phone, sometimes more.<p>Now, if you lose your credit card, you use your phone to disable it. If you lose your keys, you use your phone to uber. If you leave your wallet at home, you sign up for Kroger pay while standing in line, using the card number you stored in a notes file for exactly that kind of thing(true story).<p>It might slightly increase the risk of some pretty big disasters for some people, but for most of us, I think overall it removes a lot of common failure modes from life, so we accept the downsides.
blfr将近 3 年前
Only banks do that. All other services accept TOTP (which you can have on multiple devices) or YubiKeys&#x2F;webauthn&#x2F;U2F (where you can add multiple hardware keys).<p>And even here, my bank accepts two (or more) devices with an active instance of their app. So the solution to this spof is the same as always: redundancy. You need a second phone. Your old one is probably good enough.
评论 #32397184 未加载
评论 #32398030 未加载
simonblack将近 3 年前
<i>i can&#x27;t log in to any of my banks without my phone.</i><p>Check with your bank. Most banks have another capability of verifying who you are on login. That usually consists of a random-number generator that is in lockstep with a similar one within the bank&#x27;s system. The random-number supplied by your &#x27;token&#x27; should be the same as the one generated by the bank that is associated with your account or login.<p>We have three of these. One for each of the banks we deal with.<p><a href="https:&#x2F;&#x2F;pic.pimg.tw&#x2F;abcwithyou&#x2F;1348639177-1831387207.jpg" rel="nofollow">https:&#x2F;&#x2F;pic.pimg.tw&#x2F;abcwithyou&#x2F;1348639177-1831387207.jpg</a><p>We don&#x27;t use any of the bank smartphone apps. I dislike intensely trying to do broadsheet work on tiny phone screens. It&#x27;s akin to trying to do &#x27;keyhole surgery&#x27;. I much prefer my 3840x2160 view and at a non-microscopic scale on my computer screen.
throwaway787544将近 3 年前
I use Google Voice, and the number that I use for PINs I can login to with just a password. That way I can always access text messages even if my phone is gone. You need it when traveling and your shit gets jacked.<p>I haven&#x27;t tried it but an Android emulator should allow you to use apps without a smartphone.
评论 #32397177 未加载
评论 #32397172 未加载
评论 #32397731 未加载
评论 #32397180 未加载
DarkwingDuckFan将近 3 年前
Ask your bank and other to give you a different way for authentication. You will get a other tool for that. There are serval hardware-authenticators and other tools out there and each bank or service offers this to you. Its yourself who create this single point of failure. I have a second (old) phone at home, ready for reactivation if needed. I am teaching my kids to not use the same Mailadress &#x2F; mobile number for each service and to be sure to have a good backup for really important accounts (really important for my kid means: for Steam and other games). Try to find different way to get the authentication. They exist. The only disadvantage is: you have to ask and it isn&#x27;t as simple as an mobile.
rodolphoarruda将近 3 年前
This has been my point for the last 5 or 10 years. That&#x27;s why I have a &quot;home phone&quot; with banking apps, 2FA and important stuff installed. It has no SIM card and never leaves home. For everything else I have my &quot;street phone&quot;.
评论 #32397505 未加载
评论 #32397421 未加载
评论 #32397858 未加载
wizofaus将近 3 年前
I&#x27;m definitely not a fan of forcing anyone to use their (personal) phone for MFA for accessing company resources - I wouldn&#x27;t really consider it a single point of failure though unless it was so poorly set up that there was literally no alternative log in method in the case of a lost&#x2F;forgotten&#x2F;broken phone. And if that happens it&#x27;s the company&#x27;s loss not mine - yes I enjoy my work and don&#x27;t like letting my team members down but I can happily find other things to do if I can&#x27;t access the systems I need to work (and they&#x27;re going to pay me either way).
discreditable将近 3 年前
Next time you upgrade, keep the old phone. Have both phones set up so they can do mfa. If you are doing OTP, make sure to use an app that allows you to backup&#x2F;export. AndOTP is very good if you&#x27;re an Android guy.
unethical_ban将近 3 年前
I agree, mostly because of the lack of self-managed MFA mobility.<p>The ideal situation is for a site using 2FA to allow me to choose the 2FA application: Google Authenticator, Authy, OneAuth(I think), etc.<p>Tools like Okta Verify, RSA, Symantec, or SMS based 2FA make the phone a true SPOF. You can&#x27;t have backup codes, you can&#x27;t migrate installations. In other words, I hate forcing my phone to be an irreplaceable hard token lest I drop it in the river and have to do a bunch of resets.
jolmg将近 3 年前
&gt; i can&#x27;t log in to any of my banks without my phone.<p>What country is this? Are you sure they&#x27;re not just heavily pushing for the use of the apps while still having an alternative? What happens if when you open an account you tell them that you have neither an Android nor Apple phone? There&#x27;s probably still plenty of options for such phones, and it&#x27;s hard to think they&#x27;d refuse to open an account unless you buy a phone of their choice.
yokoprime将近 3 年前
Not true at all. If they are able to log into your e-mail, then things will start to fall apart. But just getting your phone will not allow anyone to break into your MFA secured accounts. Your phone is something you own, but they still need something you know (i.e. your password). I feel like you might get a more nuanced perspective by looking into security related topics, specifically around authentication.
评论 #32397629 未加载
评论 #32397583 未加载
unreal37将近 3 年前
So let&#x27;s say you change phone numbers and FORGET to change one of the important websites that use that number for authentication?<p>Or you change phones, wiping the old one before selling it to your friend and setting up the new one from scratch?<p>Some websites are terrible&#x2F;impossible at letting you recover your account when you&#x27;ve lost access to the phone number or the exact instance of the phone used for authentication.
评论 #32399643 未加载
2-718-281-828将近 3 年前
That&#x27;s why I have three phones fully set up (two would be sufficient, but I just happen to have an iPhone and two OPs).<p>Technically you can also set up an additional Authenticator on your computer. But my bank authorization are either app based or phone number dependent - so one main phone featuring both and additional phone having the app set up.<p>I don&#x27;t like it either.
daneel_w将近 3 年前
Are you saying all of these systems enforce SMS-based 2FA rather than the sane choice of TOTP? That&#x27;s unwise and unfortunate.
评论 #32396854 未加载
评论 #32396922 未加载
EVa5I7bHFq9mnYK将近 3 年前
I have a virtual phone number to receive SMS from all my banks and other services. Funny thing, their phone app doesn&#x27;t work reliably, but their Windows app does. So I use desktop to log into all my accounts. If I lose both phone and notebook, it&#x27;s easy to recover, I only need virtual phone username and password.
childintime将近 3 年前
By chance I saw this:<p><pre><code> https:&#x2F;&#x2F;support.google.com&#x2F;fi&#x2F;answer&#x2F;6330195?hl=en </code></pre> It allows the data to be used on a second device, on the same SIM&#x2F;number. Not SMS though, so this is going to be a limited solution. I also don&#x27;t know how this works across the globe.
SergeAx将近 3 年前
It is not a smartphone, it is your phone number most of the time. It is binded to the SIM-card. You may switch the card to another smartphone if yours is broken, or order a replacement SIM-card of you lost it. The latter is done by your cell provider with your identity confirmation.
miav将近 3 年前
I haven&#x27;t lost my phone yet, but it&#x27;s only a matter of time before I get unlucky enough.<p>I&#x27;m prepared for it by using ProtonMail for my main email with (strong, memorized) password only, no 2FA and Starling for my bank, which allows you to log in with password + video of yourself.
NaughtyShiba将近 3 年前
But that’s kinda convinient [1]. The problem is, that there’s no real proper fallback&#x2F;backup-plan.<p>[1] not only it’s convinient, it’s also similar to what all the future predictions regarding technology said. Some small gadget or bracelet connecting over air and doing stuff.
评论 #32396933 未加载
durnygbur将近 3 年前
&gt; i can&#x27;t log in to any of my banks without my phone<p>Glad it&#x27;s not only my problem. Force banks to support TOTP. They will not do it voluntarily, they have too many &quot;experts&quot; selling dedicated app to the managements because &quot;securitay&quot;.
travisporter将近 3 年前
Others have brought up 2FA. I&#x27;ve been looking for a simple (RSA SecurID FOB style) display device that only provides OTP codes. Does such a thing exist? I&#x27;m not even above buying a dozen of those old FOBs if it gets the job done
malepoon将近 3 年前
This is why I love (WebAuthn) security keys: it&#x27;s completely separate from your phone (and easy to register a second&#x2F;third key as backup for in a safe location) so you eliminate this whole class of issues.
Helikentio将近 3 年前
I have a few yubikeys.<p>I have a folder with recovery codes.<p>I have a fully encrypted phone.<p>I can afford a cheap backup phone.<p>I never felt as secure as I do currently.<p>Partially thanks to Google and the effort they put in 2fa.<p>I&#x27;m happy to have that than needing to drive to my bank for a paper printout.
jerryzh将近 3 年前
Because it is indeed the thing every one carries almost all the time. Can you do these things without your passport&#x2F;ID&#x2F;driving license before smartphone appears?
评论 #32402591 未加载
hypertele-Xii将近 3 年前
Your choice of banks.<p>I still have my bank&#x27;s physical code-slip and can sign in using it just fine.<p>My fiance&#x27;s bank provided her with a small, calculator-looking battery-powered code device.
f6v将近 3 年前
It’s a trade-off. It’s very convenient for me to pay with ApplePay. But there’s a risk I won’t be able to pay for groceries if my iPhone is out of juice.
seydor将近 3 年前
It&#x27;s a temporary phase, next generation phones will be surgically implanted under the skin so no fear of ever losing them.
评论 #32402310 未加载
waspight将近 3 年前
How do I backup all my 2fa that I have on my phone? I would like to have a backup at home in case of the phone being stolen.
评论 #32400566 未加载
achow将近 3 年前
Doesn&#x27;t 2FA include emails?<p>I always get my OTP verification codes (banking, corp login etc.) both on mobile and at my email id.
lajosbacs将近 3 年前
I have two smartphones for 2FA, one never leaves the house. But it would still losing one while traveling.
评论 #32398040 未加载
douglee650将近 3 年前
It’s a physical device with access control that is unique to a single human, three nines
aikinai将近 3 年前
What country are you in? I’ve lived in a few, and I don’t have any services that require my phone. Many have two-factor auth, but I just save the keys in my password manager which I can access from any of my devices.
throwaway98797将近 3 年前
if only that was a way to prove who you are through some kind of system<p>oh I don’t know like private&#x2F; public key infrastructure that works well in crypto<p>solutions are clear
coffee33go将近 3 年前
Then change the bank you deal with. At least in EU, this 2FA was due to PSD.<p>Please also note that any changes will impact some people. How often do you lose your smartphone? If every month then it is sad. You need to find a bank that still uses cheques etc.<p>No point in whinging. If something works for 90 % people then get used to it.<p>For example, I did not like joining facebook for my children&#x27;s school nor whatsapp groups but did it as most of them did it.
评论 #32398018 未加载
评论 #32397424 未加载
alldayeveryday将近 3 年前
Why did gasoline become a single point of failure in automobiles? Why did the strings on my guitar become a single point of failure?<p>Creating redundancy for every dependency is not always practical or economical.
评论 #32396915 未加载