4 ms·
Better to just ditch passwords altogether. If maybe 5% of the accesses the site requires authentication (the other 95% passthru cause you have the cookie) - ma
by dpweb 10y ago
Better to just ditch passwords altogether.
If maybe 5% of the accesses the site requires authentication (the other 95% passthru cause you have the cookie) - make that 5% use a text code to your phone.
EDIT: App on yr phone, not an SMS
No more passwords.
- beefhash 10y agoWhich then requires: 1. every site to obtain some automatable way to send text messages, which can get mildly expensive, 2. people to acquire at least one burner phone for authentication because they don't want $randomwebsite to have their real phone number, and 3. users to give up some degree of anonymity because the country of origin can't be hidden behind a proxy, as the phone number gives it away. This sounds like an overall loss for everybody to me.
- fpgaminer 10y agoText messages are incredibly insecure because of how easy it is for someone to take over your phone number.
- dpweb 10y agoSo Google and Microsoft use 2FA cause texts are more insecure? If I lose control of my phone they're into all my websites anyway.
- simple10 10y agoYes, texts are insecure for 2FA. It's better to use Google Authenticator or similar. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...
- pdpi 10y agoNot losing control of your phone. Losing control of your phone _number_. There's plenty of stories around of spear phishing attacks involving attackers taking over the victim's phone number. Mobile operators are notoriously vulnerable to that sort of shenanigans.
- kkl 10y agoLosing control of your actual phone is not the same as losing control of your phone number. I'm not sure about Microsoft, but Google supports several other 2FA mechanisms in addition to SMS.
- dTal 10y agoYet another reason to use SMS encryption (which seems oddly rare) like SilenceIM (formerly SMSSecure, formerly the dropped SMS code in TextSecure [now Signal]).