3 ms·
> Put another way: if you're storing the passwords in the same place as the MFA secrets, then it's not actually MFA anymore. Sure, but PyPI was also giving awa
by insanitybit 3y ago
> Put another way: if you're storing the passwords in the same place as the MFA secrets, then it's not actually MFA anymore.
Sure, but PyPI was also giving away yubikeys. Also, you're assuming that the compromise involves fully owning a device instead of the much more common case of phishing/password reuse.