3 ms·

Just remember, clicking on refresh and searching the net what is going on want make the problem go anyway faster. Few of us urgently depend on email just this h

Just remember, clicking on refresh and searching the net what is going on want make the problem go anyway faster. Few of us urgently depend on email just this hour. An even if you do setting your alarm to some suitable interval and just doing something else is much more productive. Just act like the Arab cliche taxi driver who takes the hands of the steering wheel when it gets tight and say Allah will steer (No insult to anyone, I have never visited any Arab country. Probably the story is not true anyway, but a nice anecdote to accept things you cannot change.) When hackernews was down recently I wanted to report it as big news in our company chat. But it was rather late here and I had already closed all work stuff for the weekend. So I first slept and when I woke up everything was working again. Oh yeah, I missed to share the scoop with my colleagues, but I guess I'll manage without any damage to my professional reputation. Edit: Reading post-mortem afterwards is a different story. If it's well written instead of some corporate communications emptyspeak one can learn something. No mistake happens only once.

gruez 4y ago
>Few of us urgently depend on email just this hour. I agree that you shouldn't be manically refreshing your email every 5 minutes, but my mail service being down for a few hours would definitely be a major inconvenience if I needed to get a 2fa code during that time. Same if I needed to look at my email to view my tickets for an upcoming event.
- usr1106 4y ago
  That sounds like an fragile setup if you depend on a single email account to get 2FA codes. I have them configured typically on my office workstation (reachable remotely if everything works), on my laptop, on my phone, and I have the static backup codes in my password manager which is also distributed over several indpendent machines. Of course if you have to respond to incoming tickets within a guaranteed short timeframe that gets a problem if nothing can come in. Make your risk assessment in advance: Can I live without it for a while, in the worst case even until I have an alternative provider? If so then just do so when an outage happens. If that's not acceptable for your case you need to have an independent backup before the first outage.
- favourable 4y ago
  It's a misfeature using e-mail for 2FA login codes. TOTP is far more reliable. Any service doing e-mail only 2FA should be called out and questioned. Never assume a user has access to their email at all times.
  - usr1106 4y ago
    Right, I must admit I had never heard of email being used for 2FA codes. Is that some kind of standardized protocol or something completely homegrown? In the far past (and still today with 2 banks) I use hardware/smartcard based solutions. But everything vaguely IT world seems to use TOTP. They typically advertise it as Google Autenticator, but I use different FOSS implementations on both PC and phone and they have worked 100% smoothly.
    - gruez 4y ago
      > Right, I must admit I had never heard of email being used for 2FA codes. Is that some kind of standardized protocol or something completely homegrown? If you don't have 2fa explicitly set up and browse with VPN enabled, you'll frequently get sites that want you to authenticate via email. Amazon does this, for instance.

gruez 4y ago

>Few of us urgently depend on email just this hour. I agree that you shouldn't be manically refreshing your email every 5 minutes, but my mail service being down for a few hours would definitely be a major inconvenience if I needed to get a 2fa code during that time. Same if I needed to look at my email to view my tickets for an upcoming event.

usr1106 4y ago
That sounds like an fragile setup if you depend on a single email account to get 2FA codes. I have them configured typically on my office workstation (reachable remotely if everything works), on my laptop, on my phone, and I have the static backup codes in my password manager which is also distributed over several indpendent machines. Of course if you have to respond to incoming tickets within a guaranteed short timeframe that gets a problem if nothing can come in. Make your risk assessment in advance: Can I live without it for a while, in the worst case even until I have an alternative provider? If so then just do so when an outage happens. If that's not acceptable for your case you need to have an independent backup before the first outage.
favourable 4y ago
It's a misfeature using e-mail for 2FA login codes. TOTP is far more reliable. Any service doing e-mail only 2FA should be called out and questioned. Never assume a user has access to their email at all times.
- usr1106 4y ago
  Right, I must admit I had never heard of email being used for 2FA codes. Is that some kind of standardized protocol or something completely homegrown? In the far past (and still today with 2 banks) I use hardware/smartcard based solutions. But everything vaguely IT world seems to use TOTP. They typically advertise it as Google Autenticator, but I use different FOSS implementations on both PC and phone and they have worked 100% smoothly.
  - gruez 4y ago
    > Right, I must admit I had never heard of email being used for 2FA codes. Is that some kind of standardized protocol or something completely homegrown? If you don't have 2fa explicitly set up and browse with VPN enabled, you'll frequently get sites that want you to authenticate via email. Amazon does this, for instance.