4 ms·
A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but securi
by askvictor 5y ago
A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but security is always a trade-off), so if you're phone's broken you can move the SIM to another one. Or a phone call to a pre-registered landline that will read out a code to you. As well as the paper/printable emergency codes.
That said, there's always going to be compromises and annoyances - I've been using MFA for 10+ years, and occasionally something glitches out, but other things (e.g. basic password systems) also sometimes glitch out, and having an account compromised is much, much worse than a minute or two of mild annoyance.
- tjoff 5y agoNot everyone has a SIM to begin with. Or it is lost with the phone. Anything that has a single or dual point of failure is dead on arrival. Too bad you will realize only after you are locked out of all your digital life.
- bawolff 5y agoAuthentication always has a single point of failure: you. If other people could log in as you it would defeat the point
- tjoff 5y agoThat is at least within my control, I can live with that.
- remus 5y agoFor what it's worth, google's MFA setup is the best of any I've used. You can (and should) setup a variety of second factors on your google account so that if one of them fails for some reason you've got other options. Between backup codes, TOTP, pixel phone verification and multiple FIDO keys there's plenty of options. This compares very favourably to, say, AWS where you can only have a single second factor and the recommended(!) way of protecting against loss of a second factor is to have multiple accounts with different second factors registered to each of them.
- riffraff 5y agoGoogle also has a TOTP fallback, which solves the "I want my second factor to be my laptop" perfectly.
- matt_f 5y agoReally? How is this activated or enabled?
- remus 5y agoGo to some google service > profile menu dropdown in the top right > manage your google account > security > signing in to google > security > 2 step verification. You can then 'add more second steps to verify it's you' including an option for an authenticator app (i.e. totp). Also worth generating some backup codes while you're at it.