4 ms·

Quantitatively, how much more secure would using two factor authentication be over what the author is doing? Edit: Assuming that someone only crafts 9-plus-cha

by ap22213 10y ago

Quantitatively, how much more secure would using two factor authentication be over what the author is doing? Edit: Assuming that someone only crafts 9-plus-character passwords that don't show up in dictionary attacks and aren't reused across sites, is 2FA going to secure that person much more? I'm not challenging 2FA. Actually, I'm just trying to motivate myself to use it.

shaftway 10y ago
If done properly, immensely. Sites can log invalid password attempts, and unscrupulous sites could include attempted usernames and passwords. That basically gives them a dictionary of accounts to try, because let's face it, most people use the same password for multiple services. Sometimes people's muscle memory kicks in and they accidentally type their password into the wrong site, or the wrong field. With Google's 2FA, you need access to either a pre-printed list of emergency codes, or the ability to see the person's incoming texts. That's where the "if done properly" caveat comes in. Google Voice is generally a bad idea. If someone accidentally gets into your email because you left it open, they also have access to your incoming texts.
- newjersey 10y ago
  I'd like to respectfully disagree. When done correctly, Google Voice can be as good as if not better than a traditional cell phone. I treat my email with more care than I treat my bank accounts. However, Google Voice is probably not as good as the app on your phone though.
  - shaftway 10y ago
    https://support.google.com/accounts/answer/185834?hl=en#gvoice https://support.google.com/accounts/answer/185834?hl=en#gvoi... I remembered the advice, but not the reason. It's because you can easily lock yourself out of any way to get your otp. So maybe it's too secure?
    - newjersey 10y ago
      Ah. I have an app for my main Google account but for other Google accounts, I have them sent to my Google Voice number. (: Mostly because I'm lazy and want to copy paste from hangouts on the computer.
- kennydude 10y ago
  Using Google Authenticator app (or any TOTP app, I use 1password), you skip the need for access to incoming SMS
CydeWeys 10y ago
There are entire classes of attack that 2FA protects against that you are completely screwed without. Some examples: You use a computer that has a key logger, or you get infected with a key logger, or a hardware key logger is installed inline with your keyboard cable. Someone shoulder surfs you while you log in. Someone points a video camera at your keyboard while you log in. Someone uses an RF vulnerability to wirelessly snoop the RF signals as you log in on a keyboard. You get phished (a good phishing page, not a pathetic one). You get tricked into entering your password into a popup dialog box that appears to be a "Log in with your Google account" dialog, but isn't.

by ap22213 10y ago

shaftway 10y ago

If done properly, immensely. Sites can log invalid password attempts, and unscrupulous sites could include attempted usernames and passwords. That basically gives them a dictionary of accounts to try, because let's face it, most people use the same password for multiple services. Sometimes people's muscle memory kicks in and they accidentally type their password into the wrong site, or the wrong field. With Google's 2FA, you need access to either a pre-printed list of emergency codes, or the ability to see the person's incoming texts. That's where the "if done properly" caveat comes in. Google Voice is generally a bad idea. If someone accidentally gets into your email because you left it open, they also have access to your incoming texts.

newjersey 10y ago
I'd like to respectfully disagree. When done correctly, Google Voice can be as good as if not better than a traditional cell phone. I treat my email with more care than I treat my bank accounts. However, Google Voice is probably not as good as the app on your phone though.
- shaftway 10y ago
  https://support.google.com/accounts/answer/185834?hl=en#gvoice https://support.google.com/accounts/answer/185834?hl=en#gvoi... I remembered the advice, but not the reason. It's because you can easily lock yourself out of any way to get your otp. So maybe it's too secure?
  - newjersey 10y ago
    Ah. I have an app for my main Google account but for other Google accounts, I have them sent to my Google Voice number. (: Mostly because I'm lazy and want to copy paste from hangouts on the computer.
kennydude 10y ago
Using Google Authenticator app (or any TOTP app, I use 1password), you skip the need for access to incoming SMS

CydeWeys 10y ago

There are entire classes of attack that 2FA protects against that you are completely screwed without. Some examples: You use a computer that has a key logger, or you get infected with a key logger, or a hardware key logger is installed inline with your keyboard cable. Someone shoulder surfs you while you log in. Someone points a video camera at your keyboard while you log in. Someone uses an RF vulnerability to wirelessly snoop the RF signals as you log in on a keyboard. You get phished (a good phishing page, not a pathetic one). You get tricked into entering your password into a popup dialog box that appears to be a "Log in with your Google account" dialog, but isn't.