3 ms·
So a session token can downgrade an account from 2FA to 1FA. I'm pretty sure Google forgot to inform users about this new feature.
by tumetab1 6y ago
So a session token can downgrade an account from 2FA to 1FA.
I'm pretty sure Google forgot to inform users about this new feature.
- eldridgea 6y agoA session token is "something you have" and paired with the password being "something you know" it's still 2fa. Whether making that conversion or allowing disabling of 2fa without requiring the user to do a full authentication with both their password and a code is debatable. But 2fa is two of something you "know", "have", or "are" which password + session token meets.