5 ms·
Clearly an improvement but let's face it - once you loose/break the keys you will have to go through an extensive verification process (up to 3 days according t
by _pdp_ 8y ago
Clearly an improvement but let's face it - once you loose/break the keys you will have to go through an extensive verification process (up to 3 days according to google) and there is no guarantee you will pass that stage either. Let's be mindful that more security is at the expense of less accessibility and in some places this is simply not going to cut it.
- zaarn 8y agoGenerally having backup keys is recommended so you don't have this single point of failure.
- _pdp_ 8y agoYour backup key is the second hardware token. You don't have any other backup keys :)
- zaarn 8y agoYou can have more than two hardware tokens on your account, the lowest limit I've ever seen is 5. If you break 5 keys at once, I think having to go through some verification is warranted.
- _pdp_ 8y agoSure. That will be the case in extreme circumstances like your tokens for the AWS root account, etc. The average consumer will have only two at best.
- zaarn 8y agoBut how likely is it that they loose two keys at once, especially since one is basically made to be part of the keychain...
- cjcampbell 8y agoAnd if your second key is not convenient to access, the typical user will not remember to link it to their account as a backup.
- zaarn 8y agoWhich is why Google Advanced Protection requires you two register two keys for it to work, not only one.
- cjcampbell 8y agoIt’s lovely when this is the case, but not always (though keeping accounts/keys in sync gets messy) Unfortunately, for an AWS root or IAM account, the limit is still one per https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_u2f.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...
- crispyporkbites 8y agolost my aws 2fa on a free tier account, after 12 months it started charging around $5/month, they wouldn't let me shut down my account without a signed document from a lawyer identifying me (this would have cost me £60 and a load of time/hassle), this went on for months until my credit card expired and they stopped billing me.
- zaarn 8y agoThat's really the fault of AWS having a bad security policy (U2F standard documents recommends storing multiple keys for this purpose)
- alexis_fr 8y agoIf you are in a foreign country and your mobile phone was stolen...
- zaarn 8y agoHow often does that happen? For the average user this is very very unlikely.
- freehunter 8y agoThe average person worries about plenty of things that are very very unlikely to happen to them, but it still worries them enough to pick an option that is more likely to harm them, but in a less scary way.
- technofiend 8y agoThen you pull the printed backup codes out of your wallet.
- ecesena 8y agoNote that this is only for a login from a new device. If you have your phone, you can change the settings easily. Same if you have a browser already logged in.