3 ms·

It actually drives me mad when services turn on 2FA when I absolutely don't want them to. I had a Google account with 2FA disabled, because I planned to go abro

It actually drives me mad when services turn on 2FA when I absolutely don't want them to. I had a Google account with 2FA disabled, because I planned to go abroad where it would be impossible or very costly to receive SMS. And you guess what? When I tried to log in there, Google demanded that I send in code! I was able to circumvent it only by VPNing to my office and logging in from there.

deleted 6y ago
[deleted]
yuliyp 6y ago
Those situations are tricky: that type of login looks very much like a compromised account.
- Andrew_nenakhov 6y ago
  If a user, in clear and sober mind, disables 2FA, he accepts the risk of his account being compromised.
  - jsnell 6y ago
    It's not just the user's choice to make. They are not risking just themselves, they're risking all the other users that could be harmed by the compromise of their account. The bitcoin scam videos posted on YouTube, the fake Facebook likes, the spam sent to random Xbox accounts, the fraudulent credit card charges done on in-app purchases in an attacker-controlled app that get charged back, the Mugged in London scams sent to their email contacts, etc. What you're saying is basically "if I don't wear a mask during a pandemic, I accept the risks of catching the virus". No. You are opting an indefinite number of other people into transitively catching the virus despite not accepting that risk.
    - Andrew_nenakhov 6y ago
      > if I don't wear a mask during a pandemic, I accept the risks of catching the virus No, your metaphor is rather flawed. Better one would be "if I don't see anyone during a pandemic, I do not need to wear a mask." If anyone hacked my email account, I would certainly be harmed, with a very low probability. However, Google made sure that I was _certainly_ harmed by it: for quite some time I could not access a vitally important information, which caused me significant stress. Apologists such as you miss the point: I specifically foresaw the situation, and disabled 2FA to avoid it. And still, Google decided that it knows better. Well, that was before I decided that I know better and deGooglified my life. Chrome->Firefox, Google.com->DDG, you know the drill.
- theduder99 6y ago
  I can tell Visa I will be going abroad so that they can proactively be aware of where I'm traveling. Perhaps google could add a similar feature.
deleted 6y ago
[deleted]
jpalomaki 6y ago
That’s not the regular 2FA. It’s another security check that kicks in when Google detects suspicious login. This can happen also with accounts that have not been ever configured for 2FA. I assume you never run into this if you configure for example the TOTP 2FA (use code generator on your phone).
qwertox 6y ago
One of the 2FA methods offered by Google is a printable list of one-use codes. Like the paper TAN-lists which were popular with banking.

deleted 6y ago

[deleted]

yuliyp 6y ago

Those situations are tricky: that type of login looks very much like a compromised account.

Andrew_nenakhov 6y ago
If a user, in clear and sober mind, disables 2FA, he accepts the risk of his account being compromised.
- jsnell 6y ago
  It's not just the user's choice to make. They are not risking just themselves, they're risking all the other users that could be harmed by the compromise of their account. The bitcoin scam videos posted on YouTube, the fake Facebook likes, the spam sent to random Xbox accounts, the fraudulent credit card charges done on in-app purchases in an attacker-controlled app that get charged back, the Mugged in London scams sent to their email contacts, etc. What you're saying is basically "if I don't wear a mask during a pandemic, I accept the risks of catching the virus". No. You are opting an indefinite number of other people into transitively catching the virus despite not accepting that risk.
  - Andrew_nenakhov 6y ago
    > if I don't wear a mask during a pandemic, I accept the risks of catching the virus No, your metaphor is rather flawed. Better one would be "if I don't see anyone during a pandemic, I do not need to wear a mask." If anyone hacked my email account, I would certainly be harmed, with a very low probability. However, Google made sure that I was _certainly_ harmed by it: for quite some time I could not access a vitally important information, which caused me significant stress. Apologists such as you miss the point: I specifically foresaw the situation, and disabled 2FA to avoid it. And still, Google decided that it knows better. Well, that was before I decided that I know better and deGooglified my life. Chrome->Firefox, Google.com->DDG, you know the drill.
theduder99 6y ago
I can tell Visa I will be going abroad so that they can proactively be aware of where I'm traveling. Perhaps google could add a similar feature.

deleted 6y ago

[deleted]

jpalomaki 6y ago

That’s not the regular 2FA. It’s another security check that kicks in when Google detects suspicious login. This can happen also with accounts that have not been ever configured for 2FA. I assume you never run into this if you configure for example the TOTP 2FA (use code generator on your phone).

qwertox 6y ago

One of the 2FA methods offered by Google is a printable list of one-use codes. Like the paper TAN-lists which were popular with banking.