4 ms·
To be fair, remote access to the user’s account on the machine is game over, regardless. Knowing the password and having access to a trusted (don’t ask again f
by kogir 6y ago
To be fair, remote access to the user’s account on the machine is game over, regardless.
Knowing the password and having access to a trusted (don’t ask again for 30 days checkbox) device is possession of two factors.
Google offers stricter validation in the form of advanced protection, which isn’t so easily disabled.
https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- frei 6y agoI just enrolled in advanced protection, and was then able to unenroll without 2FA re-auth.... I agree that requiring 2FA re-auth on trusted devices to disable 2FA would be a terrible default for users with only one method, but Advanced Protection should do more.
- ec109685 6y agoYeah, why wouldn’t the hacker wait until the user logged into their 1Password manager start stealing passwords that way?
- lordlimecat 6y agoIt is easier to trick the user into starting a remote session Than it is to convince them to unlock their vault. It's somewhat like getting someone to invite you into their home VS convincing them to open their fire safe in front of you. One of those sets off alarm bells.
- lordlimecat 6y agoRemote, unprivileged access is not game over and its ridiculous to make that claim in the world of cloud tenants.