4 ms·
Which in itself is a problem: it means the MFA device is not required, if only they have access to my email + phone.
by stingraycharles 7y ago
Which in itself is a problem: it means the MFA device is not required, if only they have access to my email + phone.
- burntsushi 7y agoSure, I know. Just pointing out that, at least for AWS, you do not need recovery codes or a second device for MFA. For me personally, phone+email is good enough for my threat model.
- mschout 7y agoYes, AWS MFA is very poorly implemented.