3 ms·

These solutions don't solve reliability. The biggest barrier to 2fa is the fear of loss of a factor. I can reset a password with an email account, i can't res

These solutions don't solve reliability. The biggest barrier to 2fa is the fear of loss of a factor. I can reset a password with an email account, i can't reset a 2fa with an email account. As long as that will be the case adoption can not go forward.

u801e 6y ago
The way I see it, people who are careless with security have put people who are technically able to deal with things like client-side TLS certificates in a compromised position where they have to deal with SMS or email based MFA for important services like their bank, credit cards, taxes, etc. I would rather have the ability to use real security with the MFA scheme I described above (and in my other post [1]) rather than the security theater we have with email/SMS MFA. If some people aren't able to deal with that and lose access to their account, then the burden is on them. On the other hand, by using email/SMS based MFA and account recovery, the burden is on all of us for the lack of security for everyone. If someone wanted to get into the important accounts, they don't necessarily need to target the user's bank. They could target their cell phone provider or email provider and get access not only to their bank account, but any account using those as factors for authentication. With a client side TLS certificate, they would actually have to get physical access to the device and brute-force the private key passphrase in addition to the username and password for the account. [1] https://news.ycombinator.com/item?id=23583676 https://news.ycombinator.com/item?id=23583676
- MrStonedOne 6y ago
  People like you don't need any of that. You + firefox remembered passwords = more secure then a user on 2fa. This aint about you bud.
  - u801e 6y ago
    > People like you don't need any of that. On the contrary, people like me do need it. The status-quo right now is that companies are forcing us to use security theater measures to further secure our accounts. But since those measures are actually weaker than the original password, it actually reduces the actual security around our accounts. And I never use the remember password feature in my browser because I don't want to inadvertently give someone access to my account if they manage to access my machine.

u801e 6y ago

The way I see it, people who are careless with security have put people who are technically able to deal with things like client-side TLS certificates in a compromised position where they have to deal with SMS or email based MFA for important services like their bank, credit cards, taxes, etc. I would rather have the ability to use real security with the MFA scheme I described above (and in my other post [1]) rather than the security theater we have with email/SMS MFA. If some people aren't able to deal with that and lose access to their account, then the burden is on them. On the other hand, by using email/SMS based MFA and account recovery, the burden is on all of us for the lack of security for everyone. If someone wanted to get into the important accounts, they don't necessarily need to target the user's bank. They could target their cell phone provider or email provider and get access not only to their bank account, but any account using those as factors for authentication. With a client side TLS certificate, they would actually have to get physical access to the device and brute-force the private key passphrase in addition to the username and password for the account. [1] https://news.ycombinator.com/item?id=23583676 https://news.ycombinator.com/item?id=23583676

MrStonedOne 6y ago
People like you don't need any of that. You + firefox remembered passwords = more secure then a user on 2fa. This aint about you bud.
- u801e 6y ago
  > People like you don't need any of that. On the contrary, people like me do need it. The status-quo right now is that companies are forcing us to use security theater measures to further secure our accounts. But since those measures are actually weaker than the original password, it actually reduces the actual security around our accounts. And I never use the remember password feature in my browser because I don't want to inadvertently give someone access to my account if they manage to access my machine.