4 ms·

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth

by jawns 5y ago

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix? Digital OTP, like the kind provided by 1Password or Bitwarden, are a little more convenient. And having Google Voice means I can easily copy codes sent via text straight from my laptop. But it's something I'd rather not even have to pay attention to. I don't need to manually enter a code to get HTTPS.

deleted 5y ago
[deleted]
csteubs 5y ago
I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.
- detaro 5y ago
  There shouldn't be a standard convention for a "cheat code" - if the thing can do push, it just should offer it in the UI.
- Macha 5y ago
  A push notification is still a context switch so you're really only saving the time to find your authenticator app.
masswerk 5y ago
> the security benefits are worth it. Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration. (As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)

4 ms·

I'm one of your technical brethren, and non-technical people aren't the only ones who think 2FA is a pain. Don't get me wrong, the security benefits are worth

by jawns 5y ago

deleted 5y ago
[deleted]
csteubs 5y ago
I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.
- detaro 5y ago
  There shouldn't be a standard convention for a "cheat code" - if the thing can do push, it just should offer it in the UI.
- Macha 5y ago
  A push notification is still a context switch so you're really only saving the time to find your authenticator app.
masswerk 5y ago
> the security benefits are worth it. Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration. (As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)