3 ms·
Recently, the federal government has been internally promoting https://login.gov https://login.gov as an single sign-on system for all government services to th
by hyperrail 8y ago
Recently, the federal government has been internally promoting https://login.gov https://login.gov as an single sign-on system for all government services to the public.
I don't know how good it is at preventing fake accounts, but in my experience, it does get the basics right, with no max password length or character restrictions, and 2-factor authentication through phone calls or texts.
- sharkmerry 8y ago> 2-factor authentication through phone calls or texts. isnt this bad? Tying to your phone number (while more convenient) provides another vector of attack (social engineering the telecoms to get device changed)
- asimpletune 8y agoOr if someone loses their phone then there’s a window of time where an attacker can just pop in their sim.
- Felz 8y agoYou need both the password and the phone number, so compromising the phone number via social engineering still requires the password, and thus can't be less secure than just requiring the password. That's… why it's called two factor authentication? Or are you suggesting they'd let you reset your password with just the phone number?
- zwily 8y agoIt also supports TOTP codes.