3 ms·
Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those metho
by donmcronald 6y ago
Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those methods with some other arbitrary factors to make it really secure.
Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!
- geofft 6y agoIn fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.
- viraptor 6y ago> Now there are 4 ways to compromise your account. No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page. They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.