5 ms·
Not quite. It's only safer if your single priority in the world is protecting that one account. But you need to account for the larger blast radius too: it also
by dataflow 6y ago
Not quite. It's only safer if your single priority in the world is protecting that one account. But you need to account for the larger blast radius too: it also turns your SMS, phone line, and other things that revolve around them into actual attack targets, when they weren't previously. The increased potential for collateral damage can very well not be worth it.
- MaxBarraclough 6y agoAlso, it gains increased security at the cost increased chance of lockout. Water damage to your phone may now be enough to prevent you from signing in.
- ehnto 6y agoIt's notoriously difficult to regain access to many types of accounts, but that's in part because of how little we verify ourselves in the first place.
- alistairSH 6y agoWater damage would also prevent access to MFA apps like Google Authenticator. And many/most people (world-wide) are accessing the web through their mobile device anyways - so damaged phone = no web access. That leaves us with physical keys, which the average consumer probably doesn't want to carry around all the time (easy enough to keep on keychain, but most people don't carry keys around their own home).
- falcolas 6y agoGoogle Auth can be backed up (via a QR code), and it works fine on two devices simultaneously. Most places that offer 2FA auth apps also offer backup codes, which can be stored in any password manager, or offline in a little black book.
- ghgdynb1 6y agoI use 1Password for my mfa; I can access my one time passcodes from any device I’m signed in on, and my passwords and secondary authentication are conveniently managed together. If issues like water damage or losing your device are concerns for you, their service might be worth checking out. Disclaimer: I’m very far from a cybersecurity expert.
- alistairSH 6y agoTwo problems I see with this approach... 1. Consumers are terrible at security. Asking them to subscribe to a password management/MFA tool is likely to fail. If this were baked into iOS/Android, this would be better. 2. Many banks don't support this MFA scheme. A quick poke around 2fa.directory shows a massive number that don't support MFA at all, and another huge bunch that do SMS/email but not software/hardware. This puts consumers in the position of juggling multiple MFA schemes to access various sites. I don't disagree with you in principle. But until there's a more standard approach to MFA, people will continue to use SMS because it's easy and broadly available as an MFA scheme.
- ghgdynb1 6y agoOn top of that 1Password is quite pricey, albeit fully featured. I probably wouldn't use it if not for my family's plan.
- jjav 6y ago> Water damage would also prevent access to MFA apps like Google Authenticator. No, since you can back up the seed in a secure location.
- alistairSH 6y agoWhich you access through the same broken phone (for most internet users).