4 ms·
While I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is ve
by Endy 9y ago
While I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is very simple. There's the old saw that over time, computing has evolved from smart people in front of dumb terminals into dumb people in front of "smart" terminals. This attack is proof of it; and while 2FA might have had an impact, the major issue here is that we had a dumb person - this "unlucky" team member - who either didn't have the training or the common sense to understand that if you have a public presence on the Internet, you are a target. If you have auto-updating software installed on more than 1 machine, you are going to be someone's target because they want access to that person's computer.
The lesson here is: never trust anyone or anything.
- driverdan 9y ago> The lesson here is: never trust anyone or anything. Which is why you should use 2FA and why you shouldn't trust someone who says they don't use it.
- Endy 9y agoI don't trust any of the 2FA providers. And I have neither the time nor the interest to try and learn to code it in binary.
- cyphar 9y agoTOTP is a specification and there are many free software implementations. U2F is also a specification (but generally they aren't free software implementations).
- Endy 9y agoAgain - I don't trust the people who created the specifications; and I don't trust either the free implementors or the non-free ones, though my inclination would be to go with non-free if I were forced. As it is, I simply don't use services that rely on them.
- IncRnd 9y ago> The lesson here is: never trust anyone or anything. I find it interesting that most people who replied to your post were upset with you. The first maxim of programming is, "all input is evil." Good Internet Hygiene means not to click links in emails.