4 ms·

I'd personally rather it be secure by default than unsecure by default.

• thaumasiotes 7y ago
  The contrast here isn't "secure by default" vs "unsecure by default". It's whether a legitimate login can come from any computer, or only a computer Twitch recognizes as having logged in to the same account in the past. I'm not saying they should stop asking for your password. So we have "secure by default" or "secure, and also incredibly irritating, by default".
  • a_t48 7y ago
    Security in depth. It's reasonable to require 2FA for new devices.
    • thaumasiotes 7y ago
      They're not requiring 2FA for new devices: 1. I'm logging in from the same device every time. They're just freaking out because I'm in an incognito browser window. 2. They're not asking for more than one factor. The one-time code is sent to my email address. Control of the email address is already sufficient to take over the account, regardless of whether I know the account password. If you're not able to identify new devices, is it still reasonable to prevent logins from those unidentifiable "new devices"?
      • a_t48 7y ago
        I was under the impression that because of the lack of tracking in incognito, most sites regard it as a "new device". Regardless, your second point stands, makes sense. That is dumb.