4 ms·
This doesn't make sense to me. Either you confirmed that it's working (by tapping your key or entering your token) or you didn't. Why prevent the user from actu
by carbocation 8y ago
This doesn't make sense to me. Either you confirmed that it's working (by tapping your key or entering your token) or you didn't. Why prevent the user from actually securing themselves in this fashion?
- tedunangst 8y agoUsers don't actually realize the implications of "you will never login without this key" until they forget the key. That doesn't happen at the moment of enrollment, but only the day after.
- C4K3 8y agoI see it as an improved method of confirming that it's working. For power users it may be pointless, but for the average user who probably has never used any kind of 2FA (perhaps besides SMS) it makes them go through the real motions of authenticating with 2FA before turning it on for real, which will prevent many stupid user mistakes (which I admit I've done myself once.) I think it's a major improvement for ease of use in exchange for having a small once off window where you're not protected by 2FA.