3 ms·

>using MFA always reduces your personal attack surface Actually it increases it. In theory it makes attacks more difficult even with the increased attack surf

>using MFA always reduces your personal attack surface Actually it increases it. In theory it makes attacks more difficult even with the increased attack surface, but in practice, it may make it easier. Some places let you reset a password if you have the MFA. And if the MFA was on a phone, which also has your email, which is how you'd normally reset your password, then of course it's equally vulnerable.

TimTheTinker 7y ago
> Some places let you reset a password if you have the MFA. I wasn’t aware of that - that’s horrifying but not surprising. Well, in that case, disable/remove MFA! On that note, if an account requires “security questions”, consider using 1Password’s password generator, but set to 4 random words separated by spaces. That can help reduce the increased attack surface from fraudulent account recovery - use words to avoid someone saying “oh it’s just a bunch of gibberish” over the phone.