3 ms·
Security in depth. It's reasonable to require 2FA for new devices.
by a_t48 7y ago
Security in depth. It's reasonable to require 2FA for new devices.
- thaumasiotes 7y agoThey're not requiring 2FA for new devices: 1. I'm logging in from the same device every time. They're just freaking out because I'm in an incognito browser window. 2. They're not asking for more than one factor. The one-time code is sent to my email address. Control of the email address is already sufficient to take over the account, regardless of whether I know the account password. If you're not able to identify new devices, is it still reasonable to prevent logins from those unidentifiable "new devices"?
- a_t48 7y agoI was under the impression that because of the lack of tracking in incognito, most sites regard it as a "new device". Regardless, your second point stands, makes sense. That is dumb.