5 ms·

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sens

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

detuur 8y ago
Yeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.
- gambler 8y ago
  >2FA is a very cheap solution If you don't know the technologies the website is built upon or how much it will be impacted by increased barrier of entry for users, this statement is baseless.
  - Natanael_L 8y ago
    Who uses malbolge to create servers?
    - Filligree 8y ago
      I take offense at your tone, and the implied judgement. Malbolge was the right tool for us, and let us tap into a talent pool that was otherwise going unused.
bgilroy26 8y ago
If a website is smaller it may not be sticky enough for a user to feel they get enough value to put in the effort to do 2FA
- joshstrange 8y ago
  That's totally fair, but you don't have to force 2FA on your users.
  - tracker1 8y ago
    For good and bad, I happen to like social media for logins... Twitter, fb, google, ms all offer them. In the end if you get their "real name" and email address, I find that generally sufficient. You don't have to do the actual authentication, users can configure 2fa on their own. I mean, some site do ask for way more than they need here and that's often bad. In the end, I think it's a reasonable trade off for end-use convenience. Which I often am.
mrguyorama 8y ago
The one thing I dislike about 2FA as a user is, if I drop my phone in a lake, can I safely recover my account? I have a lot of time, money, effort, etc invested in my accounts, and I really don't want to lose that
- joshstrange 8y ago
  If you use something like Authy or 1Password to store your 2FA tokens then they aren't lost if you lose the phone. Does this mean a single point of failure and in someways undermine the use-case for 2FA? Sure but as with all things security you need to decide where on the spectrum you want to be. It's a game of trading security for usability base on what your situation requires.
- proneb1rd 8y ago
  You can write down on paper the private key you get when enabling 2FA. Some providers also give you a list of recovery keys.

detuur 8y ago

Yeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.

gambler 8y ago
>2FA is a very cheap solution If you don't know the technologies the website is built upon or how much it will be impacted by increased barrier of entry for users, this statement is baseless.
- Natanael_L 8y ago
  Who uses malbolge to create servers?
  - Filligree 8y ago
    I take offense at your tone, and the implied judgement. Malbolge was the right tool for us, and let us tap into a talent pool that was otherwise going unused.

bgilroy26 8y ago

If a website is smaller it may not be sticky enough for a user to feel they get enough value to put in the effort to do 2FA

joshstrange 8y ago
That's totally fair, but you don't have to force 2FA on your users.
- tracker1 8y ago
  For good and bad, I happen to like social media for logins... Twitter, fb, google, ms all offer them. In the end if you get their "real name" and email address, I find that generally sufficient. You don't have to do the actual authentication, users can configure 2fa on their own. I mean, some site do ask for way more than they need here and that's often bad. In the end, I think it's a reasonable trade off for end-use convenience. Which I often am.

mrguyorama 8y ago

The one thing I dislike about 2FA as a user is, if I drop my phone in a lake, can I safely recover my account? I have a lot of time, money, effort, etc invested in my accounts, and I really don't want to lose that

joshstrange 8y ago
If you use something like Authy or 1Password to store your 2FA tokens then they aren't lost if you lose the phone. Does this mean a single point of failure and in someways undermine the use-case for 2FA? Sure but as with all things security you need to decide where on the spectrum you want to be. It's a game of trading security for usability base on what your situation requires.
proneb1rd 8y ago
You can write down on paper the private key you get when enabling 2FA. Some providers also give you a list of recovery keys.