> I wish he'd mention what kind of 2FA...U2F/WebAuthn...origin binding...SMS It shouldn't matter, because it's irrelevant to the point of the article, which is

> I wish he'd mention what kind of 2FA...U2F/WebAuthn...origin binding...SMS It shouldn't matter, because it's irrelevant to the point of the article, which is that Facebook (at least as reported) leaves a hacking victim with little or no recourse to get their account, and sometimes livelihood back. An imperfect real-world analogy of your question is like asking about what precise brand of bear mace an assault victim was or was not carrying, and whether a better one would have helped. Perhaps it would have, but that's not the point. If having hardware tokens is so important, Facebook should be making them mandatory at its scale.