3 ms·
Ask HN: Why do some services allow you to routinely bypass 2FA
On GitHub, I have 2FA active. Whenever I try to perform some sensitive action, I'm presented with a 2FA challenge. But there is the option to simply use your password, at the bottom, which I have used frequently.
So why present the 2FA prompt at all if I can simply choose to not use it? Maybe I have that option because I'm accessing from a registered browser. Whatever the case, it's a redundant prompt.
I've seen this pattern on other online services, for example Wise.com
- josefresco 3y agoMy hosting provider used to let me bypass 2FA because they "fingerprinted" my browser (whatever that means). Thankfully they've dropped that insane idea and now force 2FA every login.
- Generalia 3y ago[dead]