4 ms·
Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.
by ironmagma 4y ago
Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.
- sureglymop 4y ago2FA is okay. But the practice of backup code sucks. Instead, save the TOTP hash and make extra sure to back it up. Then you can just reconfigure your 2FA app.
- jay-barronville 4y ago2FA/MFA isn’t the problem. Google is just a pain to deal with when their products don’t work as expected. On one hand, security-wise, it’s good that they tend to design their algorithms to err on the side of being restrictive, but on the other hand, they have no legit support, so if you or their algorithms mess up and you’re locked out of your account, you’re basically on your own. For a company so many of us rely on so deeply, that’s awful!
- ironmagma 4y agoNobody should be forced into this terrible scheme if even Google can’t get it working. It’s a case of “this idea isn’t bad, people just implement it wrong”. If nobody can implement it right, it’s not right. Complexity kills.
- MetaWhirledPeas 4y agoThe alternative is picking a smaller company that might be an easier hacking target or might go out of business when you're not paying attention. I have a Protonmail account but I do wonder how long they'll be around.
- jandrese 4y agoThis really isn't a problem with 2FA. It is a problem with Google not understanding the reason for backup codes. It's just plain old bad design on Google's part.