6 ms·
> There's no such thing as a "trade-off" when it comes to cyber security There are always trade-offs. No security is absolute, but that doesn't mean all securi
by jfk13 6y ago
> There's no such thing as a "trade-off" when it comes to cyber security
There are always trade-offs. No security is absolute, but that doesn't mean all security is worthless. And as a rule all security measures come with some associated cost/inconvenience. What trade-offs make sense will depend on many factors, such as the value of your data (both to you and to a potential attacker), the threat models you're concerned about, the people who need access to your "secure" data, etc.
- qayxc 6y ago> No security is absolute, but that doesn't mean all security is worthless. I'm not talking about absolutely secure measures here, I'm talking about watered down security measures. Just like encryption that has backdoors, weakening 2FA by providing ways around it by design makes it completely worthless. And remember that this doesn't just apply to one user - it affects all users of a platform at the same time if you allow nonsense like this. There's no trade-off to be had there - you either offer a more secure identification method or you don't. To put it in a different and simpler context: a safety gate has to have certain properties. If you remove one or more of these, it ceases to be a safety gate and becomes a regular door. A reinforced door with a cheap lock is just as insecure as a cardboard door with a security lock and a second key under the doormat or hidden under a rock outside invalidates the usefulness of even a vault door...