3 ms·
Recovery codes are generated by the server, so: • there's no temptation for the user to use them on another website, where they could leak • the server can en
by jwilk 4y ago
Recovery codes are generated by the server, so:
• there's no temptation for the user to use them on another website, where they could leak
• the server can ensure they are high-entropy (although AFAICS GitHub's recovery codes are only 40-bit…)
Moreover, if someone takes over your e-mail account, they can reset your password; but they can't reset the recovery codes.
- skrebbel 4y agoIf this is all though, then couldn't we just use username+password auth but have the server generate the password? Why at the phone to the loop at all?
- dane-pgp 4y agoAre you saying that iPhone-maker Apple and Android-maker Google (and TPM-mandator Microsoft) might not be able to imagine a future where the whole world isn't dependent on them for identity?
- skrebbel 4y agoNo, I am not suggesting that 2FA is a secret ploy by BigCos to make them needlessly important. It's perfectly possible to log into services without using your Google/Apple/Microsoft identity, even if they insist on 2FA. Use the email and SMS, Luke!