4 ms·
For services where no admin can get your access back, like most websites, a 3rd factor should be a compulsory part of 2FA. There's a balance between keeping hac
by exporectomy 6y ago
For services where no admin can get your access back, like most websites, a 3rd factor should be a compulsory part of 2FA. There's a balance between keeping hackers out and keeping yourself out. The more factors you require, the more optional factors you should also require users to have, not just optional codes but "you must write these codes down, we'll check later to make sure you did" or something like that.
- userbinator 6y agonot just optional codes but "you must write these codes down, we'll check later to make sure you did" or something like that. ...which people will still not do, or misplace/erase due to disuse, etc. Security and availability are always at odds with each other. The question that you should always have when choosing a level of security is "does the risk of denying everyone access --- including myself --- outweigh the risk of someone other than myself gaining access?"
- tomatocracy 6y agoIsn't minimising the "I lost them/forgot where I put them" scenario the point of checking you still have them (not just asking - checking eg by saying "enter one of the codes")? That way, if you don't have them, you can print a new set of backup codes while you still have your "normal" second factor to hand.