5 ms·
For you, not much. For people who make their livelihood on it, a lot. If you’re lazy and share passwords between accounts like some people do it’s also good to
by a_t48 7y ago
For you, not much. For people who make their livelihood on it, a lot.
If you’re lazy and share passwords between accounts like some people do it’s also good to know that your password might be leaked.
- thaumasiotes 7y agoBut I won't get an alert if this blocks someone else from accessing my account. The email will go to the address associated with the account, and the odds of me checking that address without knowing I need to are nearly zero. And all of that is as it should be, because attempts to compromise my Twitch account do not matter in any way at all. You'd need to be a lot more important than a non-streaming Twitch account before I'm going to provide an email address that can reach me reliably. "But how is Twitch supposed to know whether I'm a streaming account or a non-streaming account?"
- a_t48 7y agoI'd personally rather it be secure by default than unsecure by default.
- thaumasiotes 7y agoThe contrast here isn't "secure by default" vs "unsecure by default". It's whether a legitimate login can come from any computer, or only a computer Twitch recognizes as having logged in to the same account in the past. I'm not saying they should stop asking for your password. So we have "secure by default" or "secure, and also incredibly irritating, by default".
- a_t48 7y agoSecurity in depth. It's reasonable to require 2FA for new devices.
- thaumasiotes 7y agoThey're not requiring 2FA for new devices: 1. I'm logging in from the same device every time. They're just freaking out because I'm in an incognito browser window. 2. They're not asking for more than one factor. The one-time code is sent to my email address. Control of the email address is already sufficient to take over the account, regardless of whether I know the account password. If you're not able to identify new devices, is it still reasonable to prevent logins from those unidentifiable "new devices"?
- a_t48 7y agoI was under the impression that because of the lack of tracking in incognito, most sites regard it as a "new device". Regardless, your second point stands, makes sense. That is dumb.