3 ms·
To be fair, all UA say is: > Your security questions will also be used as part of upcoming two-factor authentication to further protect your account The stupi
by oneeyedpigeon 10y ago
To be fair, all UA say is:
> Your security questions will also be used as part of upcoming two-factor authentication to further protect your account
The stupid nature of the 'enum answers' aside, this doesn't necessarily mean they're not implementing 2FA properly. They might have 2F set up as securely as the very best practitioners, then have this security question crap layered on top. We need to know for sure that they think the security question is one of the two factors before tearing them a new one.
- Matt3o12_ 10y agoThey apparently think that those security questions, combined with the password, are the 2FA. Unfortunately , this is not true. 2FA authentication means something that you know and something that you have. The advantage is the second one: if the attacker has compromised your PC/password wallet, they still can't get into your account because they are missing something (you have). With UA's approach, an attacker can still successfully hijack the vicitims account if they have a key logger because UA's authentication only requires "something(s) that you know"
- oneeyedpigeon 10y agoSure, I understand what you're saying about 2FA but: > They apparently think that those security questions, combined with the password, are the 2FA. What makes you say that? I see nothing that concretely backs this up.
- dankohn1 10y agoIt's as bad as it seems. Every time you log in from a new machine, it asks for you to answer security questions, and calls it two factor, which it's obviously not.