4 ms·
This will mean no 2FA for me and many others. I'll never set up a method that depends on me not losing a particular device or an account.
by zb3 3y ago
This will mean no 2FA for me and many others. I'll never set up a method that depends on me not losing a particular device or an account.
- zalyalov 3y agoUm, is SMS not tied to not losing a particular SIM card? I guess you can try to restore your number, do all operators provide this functionality?
- zb3 3y agoMy number is tied to my government issued ID. If I lose the SIM card I can get another one simply by showing my ID. If my ID gets stolen I can get another one by visiting the Police and so on. The point is - I have some kind of an enforceable legal right to that number, whereas I currently have no such right to any particular account (and such rights can't be practically enforced for physical objects such as devices)
- KirillPanov 3y agoIt sounds like what you really want is to outsource your security to the government. Maybe you should just say that's what you want.
- zb3 3y agoI'm pretty sure you're doing this already. We have courts for a reason, technocracy is a step backwards.
- prepend 3y agoYes, that’s what I want. There’s a much lower risk, for me, or government tyranny than me losing my yubikey. Note though that it varies depending on the thing protected. For GitHub, I’m cool with the risk that the government gets a subpoena to seize my phone or SIM card and log into GitHub. For some other services like messaging, I’d rather have stronger controls.
- willcipriano 3y agoIf the government ordered it you or anyone else would be given access to your account, no matter how many factors you have.
- KirillPanov 3y agoThen store your github TOTP token on multiple devices, like I do. You can even turn it into a QR code and tatoo it on your cat's butt.
- zb3 3y agoThe first option has the same problem I mentioned, while the second sounds much less practical than SMS. Each backup might decrease the overall security, but while theoretically you can still remember TOTP tokens or write them down and put inside a safe (possible but impractical), with passkeys that's no longer possible.
- KirillPanov 3y ago> I'll never set up a method that depends on me not losing a particular device > Then store your github TOTP token on multiple devices > The first option has the same problem I mentioned Math it again.
- zb3 3y agoIf I have 2 devices, your solution still makes me depend on not losing both of them and so on. I don't want to depend on me not losing them (for example in a fire).