7 ms·

A sign of the times. Seems like our non-technical brethren find 2FA/MFA a burden? McSweeneys’ satire and parodies are rarely in good jest in my experience. Thi

A sign of the times. Seems like our non-technical brethren find 2FA/MFA a burden? McSweeneys’ satire and parodies are rarely in good jest in my experience. This is a criticism of the move towards 2FA/MFA make no doubt about it. The writer, and the editors who let this through, are not happy about this state of affairs. McSweeney’s isn’t a no-name blog or journal either — its name holds sway over those who work in literary arts.

ketzo 5y ago
I don't think there's quite as much malice as you seem to read into it. Yeah, 2FA is kind of annoying, particularly when you don't have a real concrete understanding of the reasons why it's important. It's a funny frame device to float a couple different satirical ideas. I'm sure faculty members – and most people – understand that 2FA is a necessary minor annoyance.
- mcny 5y ago
  » I don't think there's quite as much malice as you seem to read into it. Requiring signing into my Microsoft account (with two step authentication code) every twenty four hours on a company laptop you control is obnoxious. You should educate and empower your employees, not treat them as the weak link in your armor.
  - whynotminot 5y ago
    It’s naive to not treat them like the weak link though, because they really are. No amount of education (that is routinely ignored) is enough to actually change that.
    - johncessna 5y ago
      Routinely ignored implies that it's a deliberate action on the part of an employee. I don't think that's the case. The yearly security training gets treated just like the airplane safety briefing. Folks pay attention the first couple of times they encounter it, but when they realize they'll never be in a situation then it gets classified as 'could be useful, but will probably never need.' The yearly security training is probably just a compliance checkbox companies do. If they wanted an educated workforce that practices security first there are other far more effective approaches. Of course, that all ignores the fact that employees are weak links not because they are dumb, but because they don't have an incentive to protect the company when they or their families are put in danger by a threat actor.
  - pjbeam 5y ago
    I hear you, it is obnoxious, and probably not the best solution. That said the employees absolutely are weak spots in the armor.
nuclearnice1 5y ago
Is anyone happy about the accumulation of passwords, authentications and verifications required in the modern technical world? The founders and investors of 1Password, perhaps.
freshpots 5y ago
They seem to be in good jest much more than rarely to me: https://www.mcsweeneys.net/articles/oh-my-fucking-god-get-the-fucking-vaccine-already-you-fucking-fucks https://www.mcsweeneys.net/articles/oh-my-fucking-god-get-th... https://www.mcsweeneys.net/articles/its-decorative-gourd-season-motherfuckers https://www.mcsweeneys.net/articles/its-decorative-gourd-sea... https://www.mcsweeneys.net/articles/brandon-our-new-lets-go-brandon-yard-sign-has-nothing-to-do-with-your-upcoming-spelling-quiz https://www.mcsweeneys.net/articles/brandon-our-new-lets-go-...
- ineedasername 5y ago
  I thought it was a bit strange when my neighbor put up a sign to encourage me. I guess it was all more complicated than I thought.
t-writescode 5y ago
5-factor auth is an obnoxious thing and real. 1. username and password for website 2. token sent to email 3. login for email (auto logged out) 4. email 2fa that requires SMS 2FA or Google auth, stored on phone 5. pincode / face for phone edit: Oh! I could add 2 real more: -1: password manager login 0: password manager 2fa
- retzkek 5y ago
  RSA soft tokens require a PIN. Some versions it's appended to the code, some you enter it to get the code (both exist in my organization). So that's like three more factors right there.
jawns 5y ago
I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix? Digital OTP, like the kind provided by 1Password or Bitwarden, are a little more convenient. And having Google Voice means I can easily copy codes sent via text straight from my laptop. But it's something I'd rather not even have to pay attention to. I don't need to manually enter a code to get HTTPS.
- deleted 5y ago
  [deleted]
- csteubs 5y ago
  I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.
  - detaro 5y ago
    There shouldn't be a standard convention for a "cheat code" - if the thing can do push, it just should offer it in the UI.
  - Macha 5y ago
    A push notification is still a context switch so you're really only saving the time to find your authenticator app.
- masswerk 5y ago
  > the security benefits are worth it. Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration. (As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)
oconnor663 5y ago
> our non-technical brethren Nah. I currently work for NYU and find their 2FA system pointlessly burdensome. I need to type my password (in practice, unlock my password manager) and then procure my second factor every day, on every device I use. Inevitably any mobile app I need to interact with requires doing all of this again, except this time inside a custom webview that doesn't remember cookies. I have never worked for a tech company that made things this annoying, and I can't fathom how bad it must be for anyone who needs to use e.g. a screen reader.
TulliusCicero 5y ago
The two factor where I work, Google, uses security keys for the second factor. I think offering these as an alternative to the email/SMS codes would be nice, tapping a little USB nub isn’t nearly as annoying as grabbing a code from another webpage or device.
whynotminot 5y ago
Not just non-technical. It’s a huge burden. Not to mention the pain when said factor is lost. I just replaced a broken phone, and having to login in everywhere that previously required an Authenticator has not been fun.
micromacrofoot 5y ago
2FA is by definition an additional burden.
jrm4 5y ago
Hold the condescension. I wouldn't be surprised if author is from the place where the following definitely literally happened: At first, there was 2FA where you could either 1. Download the proprietary app OR 2. Get texted the code. (i.e. no "do-it-yourself" e.g. Google Authenticator option.) This means you must have a cell phone of nearly any kind. Mostly reasonable. Turns out; option 2 cost somebody like half a cent every time it was used and also was far more popular than anticipated. So they just got rid of 2. That's all, no mitigation. And now you've DRASTICALLY increased the tech requirements for a major public school; I know of IT instructors in the place who did not actually regularly use a phone "fancy" or new enough to handle the official app. Utter BS.
Steko 5y ago
I found it to be less a satire of 2FA/MFA than of college administration busybodies in general.

ketzo 5y ago

I don't think there's quite as much malice as you seem to read into it. Yeah, 2FA is kind of annoying, particularly when you don't have a real concrete understanding of the reasons why it's important. It's a funny frame device to float a couple different satirical ideas. I'm sure faculty members – and most people – understand that 2FA is a necessary minor annoyance.

mcny 5y ago
» I don't think there's quite as much malice as you seem to read into it. Requiring signing into my Microsoft account (with two step authentication code) every twenty four hours on a company laptop you control is obnoxious. You should educate and empower your employees, not treat them as the weak link in your armor.
- whynotminot 5y ago
  It’s naive to not treat them like the weak link though, because they really are. No amount of education (that is routinely ignored) is enough to actually change that.
  - johncessna 5y ago
    Routinely ignored implies that it's a deliberate action on the part of an employee. I don't think that's the case. The yearly security training gets treated just like the airplane safety briefing. Folks pay attention the first couple of times they encounter it, but when they realize they'll never be in a situation then it gets classified as 'could be useful, but will probably never need.' The yearly security training is probably just a compliance checkbox companies do. If they wanted an educated workforce that practices security first there are other far more effective approaches. Of course, that all ignores the fact that employees are weak links not because they are dumb, but because they don't have an incentive to protect the company when they or their families are put in danger by a threat actor.
- pjbeam 5y ago
  I hear you, it is obnoxious, and probably not the best solution. That said the employees absolutely are weak spots in the armor.

nuclearnice1 5y ago

Is anyone happy about the accumulation of passwords, authentications and verifications required in the modern technical world? The founders and investors of 1Password, perhaps.

freshpots 5y ago

They seem to be in good jest much more than rarely to me: https://www.mcsweeneys.net/articles/oh-my-fucking-god-get-the-fucking-vaccine-already-you-fucking-fucks https://www.mcsweeneys.net/articles/oh-my-fucking-god-get-th... https://www.mcsweeneys.net/articles/its-decorative-gourd-season-motherfuckers https://www.mcsweeneys.net/articles/its-decorative-gourd-sea... https://www.mcsweeneys.net/articles/brandon-our-new-lets-go-brandon-yard-sign-has-nothing-to-do-with-your-upcoming-spelling-quiz https://www.mcsweeneys.net/articles/brandon-our-new-lets-go-...

ineedasername 5y ago
I thought it was a bit strange when my neighbor put up a sign to encourage me. I guess it was all more complicated than I thought.

t-writescode 5y ago

5-factor auth is an obnoxious thing and real. 1. username and password for website 2. token sent to email 3. login for email (auto logged out) 4. email 2fa that requires SMS 2FA or Google auth, stored on phone 5. pincode / face for phone edit: Oh! I could add 2 real more: -1: password manager login 0: password manager 2fa

retzkek 5y ago
RSA soft tokens require a PIN. Some versions it's appended to the code, some you enter it to get the code (both exist in my organization). So that's like three more factors right there.

jawns 5y ago

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix? Digital OTP, like the kind provided by 1Password or Bitwarden, are a little more convenient. And having Google Voice means I can easily copy codes sent via text straight from my laptop. But it's something I'd rather not even have to pay attention to. I don't need to manually enter a code to get HTTPS.

deleted 5y ago
[deleted]
csteubs 5y ago
I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.
- detaro 5y ago
  There shouldn't be a standard convention for a "cheat code" - if the thing can do push, it just should offer it in the UI.
- Macha 5y ago
  A push notification is still a context switch so you're really only saving the time to find your authenticator app.
masswerk 5y ago
> the security benefits are worth it. Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration. (As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)

oconnor663 5y ago

> our non-technical brethren Nah. I currently work for NYU and find their 2FA system pointlessly burdensome. I need to type my password (in practice, unlock my password manager) and then procure my second factor every day, on every device I use. Inevitably any mobile app I need to interact with requires doing all of this again, except this time inside a custom webview that doesn't remember cookies. I have never worked for a tech company that made things this annoying, and I can't fathom how bad it must be for anyone who needs to use e.g. a screen reader.

TulliusCicero 5y ago

The two factor where I work, Google, uses security keys for the second factor. I think offering these as an alternative to the email/SMS codes would be nice, tapping a little USB nub isn’t nearly as annoying as grabbing a code from another webpage or device.

whynotminot 5y ago

Not just non-technical. It’s a huge burden. Not to mention the pain when said factor is lost. I just replaced a broken phone, and having to login in everywhere that previously required an Authenticator has not been fun.

micromacrofoot 5y ago

2FA is by definition an additional burden.

jrm4 5y ago

Hold the condescension. I wouldn't be surprised if author is from the place where the following definitely literally happened: At first, there was 2FA where you could either 1. Download the proprietary app OR 2. Get texted the code. (i.e. no "do-it-yourself" e.g. Google Authenticator option.) This means you must have a cell phone of nearly any kind. Mostly reasonable. Turns out; option 2 cost somebody like half a cent every time it was used and also was far more popular than anticipated. So they just got rid of 2. That's all, no mitigation. And now you've DRASTICALLY increased the tech requirements for a major public school; I know of IT instructors in the place who did not actually regularly use a phone "fancy" or new enough to handle the official app. Utter BS.

Steko 5y ago

I found it to be less a satire of 2FA/MFA than of college administration busybodies in general.