3 ms·
> I don't know what the solution should be here A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Goo
by rightbyte 3y ago
> I don't know what the solution should be here
A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Google" is spyware.
I want 2FA for my bank only.
- larsla 3y ago"Login with X" is OAuth, not 2FA. 2FA is a great addition on top of a password per site. Neither a FIDO device nor an Authenticator app provides the site with any extra PI. Edit: SMS would give them your phone number, but SMS is a really bad 2FA and should not be used
- indymike 3y agoI'm not so sure this is the case. Even less safe 2FA like SMS and email seems to prevent a whole host of cheap attacks. TOTP is much better and can be as anonymous as your login is. What is sad is that misuse of 2FA data is rampant and causes people to think (rightfully so) as you do.
- CatWChainsaw 3y agoI don't want MFA everywhere either. I said recently that KYC has gotten out of control. HN doesn't rise to the level of Yubikey. Reddit shouldn't have fingerprints. Musk can kick rocks with collecting PII and employment history.