5 ms·
I would like to have the option of only needing the password and no password reset unless you visit an office somewhere in person. For like Google, banks, broke
by njarboe 4y ago
I would like to have the option of only needing the password and no password reset unless you visit an office somewhere in person. For like Google, banks, brokerages, etc. But maybe that is less secure than two-factor online systems? Seems like it wouldn't be.
- ghaff 4y agoHaving to present physical, hard/expensive to reliably forge, government-issued ID at a reputable institution is a pretty good filter against most fraud. It's also a headache even if you live somewhere with a local branch of your bank. I tried to do this during the pandemic and the local bank branch didn't have anyone who could give me the right authentication so I had to spend a couple hours going to my local brokerage office to complete a transaction.
- tialaramex 4y agoIt is, in fact, less secure than what we should have been doing for at least 5 years. You are able to give away your password to bad guys, it's really easy because it's exactly like just using the password normally except whoops this was my-bank-login.example and not my-bank.example/login or login.my-bank.example or whatever the URL usually was. WebAuthn fixes that, everybody should implement and use WebAuthn. To their partial credit RubyGems apparently noticed they ought to do this, and so this message says they're working to implement it.