2 ms·
If Paypal required non-sms based 2FA on all logins, would that help stop the issue?
by latchkey 3y ago
If Paypal required non-sms based 2FA on all logins, would that help stop the issue?
- RachelF 3y agoPaypal had it, then removed it, then added it again recently.
- deleted 3y ago[deleted]
- jedberg 3y agoSure, but also it would piss off unsophisticated users and also cause a huge increase in customer service issues with people getting locked out. That why it keeps flipping between required and optional. Way back then we would send RSA tokens to the top users to stop them from getting hacked, but since they cost $10 each and required training and setup with an agent, only top users would get them.
- themoonisachees 3y agoIf you're talking about RSA tokens as in the tokens sold by RSA Security the company, my company uses them and my team is in charge of their issuance. We've estimated the total including man-hours cost of issuing a single token at about 250€. Sure in the grand scheme of things it isn't much but I can't imagine it'd be better for PayPal, and that gets expensive fast if you send them to clients and not just employees. Part of this is of course genuine security verifications but a lot of it is due to RSA Security's obtuse design decisions. We tend to avoid them entirely and instead rely on modern SAML providers with app-based 2FA whenever we can now.