3 ms·

Good reminder that in 2fa both the factors should be secure; 2fa complements instead of replaces secure password practices.

• tialaramex 5y ago
  "Secure password practices" are at best aspirational and in most cases almost worthless. If you value security give employees unphishable FIDO tokens, require them everywhere you can (e.g. Microsoft Office 365), and make requiring them a necessary part of tenders for new IT. If you want two factors require the tokens to do that for you instead of messing about with layers of extra stuff. I can more or less rationalise outfits which don't really care about their users anyway, like Twitter, having rubbish security but I don't understand any employer including my own that still thinks passwords are a good idea in the twenty first century. Yubico will sell you tokens your employees can use to entirely defeat a bunch of the "Top problems" that are probably on the whiteboard of your "Head of cyber security" or whatever, for less than you probably spent on their Christmas meal last time there wasn't a pandemic. Crazy.