6 ms·
There is genuine disagreement about whether email qualifies as a second factor. As it is often just protected by a username and password the argument is that i
by nebulous1 7y ago
There is genuine disagreement about whether email qualifies as a second factor. As it is often just protected by a username and password the argument is that it's the same "something you know" factor as a password, or just an obfuscation of the same factor.
I will say, that if cybernews have done what they say that they've done, and PayPal are claiming that it's not a concern, then PayPal are clearly in the wrong, and that remains true even if we all agree that this isn't 2FA.
- teslademigod1 7y agoIn the forbes article cited above, the author says that cybernews showed it to him: "CyberNews claims—and the company showed me a demonstration—that it can successfully login to an account using basic credentials on a new computer. " So for now, I'd say they did what they're claiming
- teslademigod1 7y agoalso - this image: https://cybernews.com/wp-content/uploads/2020/02/security-check.png https://cybernews.com/wp-content/uploads/2020/02/security-ch... looks like it's not email as the second factor, but your device via SMS
- disiplus 7y agoit's not just email, its phone also. i recently recently logged inco company paypal from out of country and paypal complained it wants to confirm account via email, fine i confirmed. and then it said it also needs to conform the via phone. ie a call. so it is a form of 2fa. can i also complain how is 2fa a pain if multiple persons use that account. you cannot enable it if they allow only one user per account. there are workarounds where there are mutiple 2fa methods and i use the app and other person sms.
- nebulous1 7y agoI haven't looked at PayPal specifically, but if it's a standard authenticator app can you not both set it up via the QR code when you enable it while everybody is present? However, obviously the real answer is to add multiple users to the same paypal account, which apparently you can do with a PayPal Business account.
- disiplus 7y agoyeah, you are right, for totp it should work.
- AnIdiotOnTheNet 7y ago> As it is often just protected by a username and password the argument is that it's the same "something you know" factor as a password, or just an obfuscation of the same factor. All factors are just varying obfuscations of "something you know" when you get down to it though.