4 ms·
2fa is not magical. It makes an attack require more complexity, but it's not an "and be done with it," solution.
by levythe 7y ago
2fa is not magical. It makes an attack require more complexity, but it's not an "and be done with it," solution.
- lazzlazzlazz 7y agoHave you seen how severely 2FA drops the rate of unauthorized accesses? It's incredible. What have you seen that moves you to hedge on the value of 2FA?
- u801e 7y agoFor one thing, the SIM swap attack [1] [1] https://krebsonsecurity.com/tag/sim-swap/ https://krebsonsecurity.com/tag/sim-swap/ In general, relying on a second factor whose security practices aren't the best, could actually compromise security compared to having a strong and unique password. I personally wish that more banks would support 2FA authentication using a username/password in combination witH TLS client side certificates.
- ryacko 7y agoRequires forcing every PC case and laptop sold to have a slot for smart cards. Otherwise it is too inconvenient.
- u801e 7y agoYou could just put it in the certificate store on the machine rather than relying on external storage.
- UncleMeat 7y agoSIM swap is not scalable. It exists, but the scale of attacks through SIM swap is not even remotely comparable to credential stuffing.