3 ms·

> We're not, not really. We are, by definition down to single factor if you store the codes in the password vault. The argument wasn't that therefore the syste

> We're not, not really. We are, by definition down to single factor if you store the codes in the password vault. The argument wasn't that therefore the system is weak, it is just that the point of having a second/third factor is to add something that isn't already present in an attack against a system. One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system. Single point of failure. If you had the codes on a cellphone instead, firstly there is more of a chance that you would have taken your phone with you but even if you didn't, that "attack" now needs to access your phone as well. Not all attacks are strangers and not all are malicious, just somebody elevating their privileges via your status is an attack in the broadest sense, even if they did it for respectable reasons.

dividedbyzero 5y ago
> We are, by definition down to single factor if you store the codes in the password vault. Agreed, I should have worded that differently, that was just asking for someone to nitpick. But I don't think that detracts from my wider point. > One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system. TFA is talking about personal security, which I read as "private life security", not "workplace security for a software engineer on their work laptop in a semi-public space". That would be a much more high-value target with a very different threat landscape that warrants more effort to be spent on security (supported by security teams, on paid time, and having above-average security expertise).