3 ms·
That's a rather bad default. If you need two-factor authentication for a system, you probably want it to remain locked.
by zecg 16y ago
That's a rather bad default. If you need two-factor authentication for a system, you probably want it to remain locked.
- tuebor 16y agoFor strictly secondary authentication, it's much more likely that an admin will lock themselves out through local misconfiguration than an attacker will find the mechanism disabled. It's also a one-line configuration change.
- JangoSteve 16y agoI disagree. Having a 2FA that sometimes (i.e. very rarely, but not never) goes down is still safer than no 2FA, and I can never afford to be locked out of my server. However, I could also see the opposite case being made. And I assume this is precisely why they made it an easy config change, to make it behave however you prefer.