Tell HN: Somebody implemented something I wrote a blog about

Article summary

The author wrote a blog post about a missing feature in 2-factor authentication (2FA) and was recently contacted by someone who implemented the idea in their product. The author thinks this is great and more secure. The idea involves notifying the account owner when someone attempts to log in with the correct password but incorrect 2FA code. This notification is sent through a separate channel, such as email, to inform the account owner of the failed login attempt.

Main themes

• 2-factor authentication
• security features
• intellectual property
• idea implementation
• authentication systems
• security risks vs. benefits
• user behavior and security
• attribution and credit for original work

What commenters say

• Implementing the proposed 2FA feature can enhance security by notifying account owners of potential security breaches.
• The idea of notifying account owners when someone attempts to log in with the correct password but incorrect 2FA code is not commonly implemented in current 2FA systems.
• Some commenters argue that disclosing to the attacker that they got the password right is not acceptable and could be an information leak.
• Others suggest that the benefits of the proposed feature outweigh the potential risks and that it can be implemented in a way that minimizes security risks.
• The discussion highlights the importance of balancing security and usability in authentication systems.
• Some commenters share their own experiences with 2FA implementations and suggest alternative approaches to achieving similar security benefits.
• There is disagreement about the potential impact of the proposed feature on user behavior, such as writing down passwords or using clear-text files.
• The conversation also touches on the topic of intellectual property protection for ideas and the importance of attribution and credit for original work.