3 ms·
Competently administering 2FA essentially requires human intervention to handle the "I lost all my credentials" case because it will happen with probability 1 e
by Spivak 4y ago
Competently administering 2FA essentially requires human intervention to handle the "I lost all my credentials" case because it will happen with probability 1 eventually. Workplaces can do this because you can call IT and have an already established identity based in the real world.
- torstenvl 4y ago100%. I've never had any issues with IRL 2FA. If I lose or damage my CAC card I can go to the ID card office with a different photo ID and get a new one with new certificates and set a new PIN. My old certificates will be revoked. But that's not what's currently popular. What's currently popular is just to check a box with some poorly thought-out system and screw anyone who ever loses their phone number or 2FA device. That's dangerous and unprofessional.
- jandrese 4y agoThe problem with this is that we are talking about pseudo-anonymous signup for websites. They can't go back and verify the credentials you used to create the account because you didn't provide any. But if this is the case then the help desk is a major security vulnerability, since just anybody can claim to be you and take over your account. The help desk has little to no way to actually verify your identity. At the very least if the helpdesk does reset your account, there should be a 48 hour lockout and a message sent to the account allowing the owner to dispute the change. Yes it is inconvenient in cases where the actual owner lost all of their login credentials, but this is hopefully rare.