4 ms·
> Is it risky "centralizing" this data? Sure, but I don't see it any more risky as using a cloud-based password manager. Using a cloud-based password manager i
by ocdtrekkie 7y ago
> Is it risky "centralizing" this data? Sure, but I don't see it any more risky as using a cloud-based password manager.
Using a cloud-based password manager is a huge risk though. And if you've put both your passwords and your 2FA generators in the cloud, you now have single-factor authentication.
- TallGuyShort 7y ago>> you now have single-factor authentication In many cases that factor is now Google's security vs. the same reused password that is your hobby + the year you graduated high school. It this is what makes it convenient enough to always use, it's probably still a step up. It's at least a better, slightly more distributed factor. And even then they're distinct systems, possibly not even within the same cloud.
- Quai 7y agoThis. It is a real problem that a lot of people fail to understand why this is an issue.
- iudqnolq 7y agoIt's less secure, but the single factor is a stronger single factor than a password because it can't be reused. If someone mitms my login they get my password and otp code, which they ideally can't turn into something reusable (if the website requires 2FA to change security settings) and definitely can't use if they have a lag between collection and exploitation (like a keylogger that phones home every so often). This is acceptable to me, but I would prefer websites let me use a one time code as a single factor of authentication.