3 ms·

"Your 2FA authentication has been downgraded to email/password for ideological reasons."

ajross 4y ago
That's exactly my impression too. Authentication is hard. And this isn't some random site wanting to store user data, they're doing invoice management! (So... not quite handling money on behalf of users, but pretty darn close in terms of liability.) Regardless of your feelings on Big Tech and Privacy and whatnot, this absolutely looks like a security downgrade to me. If I were someone looking for para-financial services like this to phish with fake users for fraud purposes, I'd probably start with a site like Slimvoice. Personally I think there's a good argument to be made about the benefits and tradeoffs to allowing giant cloud companies to control the idea of "identity" on the internet. But if there's any market segment where big companies with deep pockets and extensive technical resources bring value, it's this one.
- catiopatio 4y ago
  > Authentication is hard. No, it’s not. It’s certainly not harder or more complicated than the OAuth protocol used support Google-based sign-in. Exactly what unique value do you believe these big companies bring, exactly?
  - rattlesnakedave 4y ago
    It actually is very hard. There’s a long tail of concerns that make it difficult to do authentication as well as a major player in the space.
    - catiopatio 4y ago
      What exactly about it is hard?
      - ajross 4y ago
        The part where you guarantee to your users that the person you authenticated is who they seem to be. In this particular example: "Is this invoice I'm about to pay for the service I purchased, or is it fraud?" Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.
esperent 4y ago
Well, only if the person has 2FA set up in their Google account, which most people don't in my experience. That aside, do you have a recommendation for auth that provides good privacy while also having wide adoption and ease of integration similar to Google or Facebook auth? And also 2FA of course. If there are no options then I think our problem is bigger than this particular dev's ideology.
- hedora 4y ago
  Username and password: Factor #1 - Thing you have: encrypted password vault. Factor #2 - Thing you know: password to said vault. Of course, this is only 2FA from the user's perspective. Meddling websites cannot ensure that you didn't memorize their password, or write it down unencrypted.
  - thealchemistdev 4y ago
    Multifactor authentication is a combination of 2 or more of the following factors. - Something you know: password. - Something you have: your phone or a physical key. - Something you are: Biometrics (finger-print, eye pattern, gait of your walk, etc.) Using 2 passwords, such as the case of knowing the password to your vault of passwords, is only 1 factor.
    - alexchamberlain 4y ago
      I think the GP was implying that the vault would store a random string, which would be unreasonable for anyone to possibly guess. This isn't either of the factors - just a proof you had both of them. The 2 factors are then the vault itself and the vaults password. It should be noted, though, this is significantly weaker than "real" 2FA, as normally that would involve some sort of challenge, rather than just storing a hard secret.
- askvictor 4y ago
  Google have enabled 2FA by default.
- deleted 4y ago
ISL 4y ago
Do we know that they haven't implemented another 2FA mechanism behind that email/password?
- cmeacham98 4y ago
  It takes all of 30 seconds to sign up an account and check. I was not offered 2FA during sign up, and cannot find anywhere on the site to enable it after logging in. If you don't believe me or think that I somehow missed it, feel free to create your own account and test.
andrepd 4y ago
Shit, I had no idea Google had a monopoly on 2fa! That's terrible.
- esrauch 4y ago
  They don't, but this website doesn't have it, right?
iLoveOncall 4y ago
And your can clearly see from the "Code" section in the same page as the privacy policy that this is only ideological and that this guy just likes to push his bad practices on others.
- epolanski 4y ago
  It's cool, people are entitled to their opinions and ideas. I too don't like third party sign ups, I think they are bad for privacy and the user.

That's exactly my impression too. Authentication is hard. And this isn't some random site wanting to store user data, they're doing invoice management! (So... not quite handling money on behalf of users, but pretty darn close in terms of liability.) Regardless of your feelings on Big Tech and Privacy and whatnot, this absolutely looks like a security downgrade to me. If I were someone looking for para-financial services like this to phish with fake users for fraud purposes, I'd probably start with a site like Slimvoice. Personally I think there's a good argument to be made about the benefits and tradeoffs to allowing giant cloud companies to control the idea of "identity" on the internet. But if there's any market segment where big companies with deep pockets and extensive technical resources bring value, it's this one.

catiopatio 4y ago
> Authentication is hard. No, it’s not. It’s certainly not harder or more complicated than the OAuth protocol used support Google-based sign-in. Exactly what unique value do you believe these big companies bring, exactly?
- rattlesnakedave 4y ago
  It actually is very hard. There’s a long tail of concerns that make it difficult to do authentication as well as a major player in the space.
  - catiopatio 4y ago
    What exactly about it is hard?
    - ajross 4y ago
      The part where you guarantee to your users that the person you authenticated is who they seem to be. In this particular example: "Is this invoice I'm about to pay for the service I purchased, or is it fraud?" Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.

esperent 4y ago

Well, only if the person has 2FA set up in their Google account, which most people don't in my experience. That aside, do you have a recommendation for auth that provides good privacy while also having wide adoption and ease of integration similar to Google or Facebook auth? And also 2FA of course. If there are no options then I think our problem is bigger than this particular dev's ideology.

hedora 4y ago
Username and password: Factor #1 - Thing you have: encrypted password vault. Factor #2 - Thing you know: password to said vault. Of course, this is only 2FA from the user's perspective. Meddling websites cannot ensure that you didn't memorize their password, or write it down unencrypted.
- thealchemistdev 4y ago
  Multifactor authentication is a combination of 2 or more of the following factors. - Something you know: password. - Something you have: your phone or a physical key. - Something you are: Biometrics (finger-print, eye pattern, gait of your walk, etc.) Using 2 passwords, such as the case of knowing the password to your vault of passwords, is only 1 factor.
  - alexchamberlain 4y ago
    I think the GP was implying that the vault would store a random string, which would be unreasonable for anyone to possibly guess. This isn't either of the factors - just a proof you had both of them. The 2 factors are then the vault itself and the vaults password. It should be noted, though, this is significantly weaker than "real" 2FA, as normally that would involve some sort of challenge, rather than just storing a hard secret.
askvictor 4y ago
Google have enabled 2FA by default.
deleted 4y ago

ISL 4y ago

Do we know that they haven't implemented another 2FA mechanism behind that email/password?

cmeacham98 4y ago
It takes all of 30 seconds to sign up an account and check. I was not offered 2FA during sign up, and cannot find anywhere on the site to enable it after logging in. If you don't believe me or think that I somehow missed it, feel free to create your own account and test.

andrepd 4y ago

Shit, I had no idea Google had a monopoly on 2fa! That's terrible.

esrauch 4y ago
They don't, but this website doesn't have it, right?

iLoveOncall 4y ago

And your can clearly see from the "Code" section in the same page as the privacy policy that this is only ideological and that this guy just likes to push his bad practices on others.

epolanski 4y ago
It's cool, people are entitled to their opinions and ideas. I too don't like third party sign ups, I think they are bad for privacy and the user.