3 ms·

Agreed. They could have done email link verification which wouldn't require the user to set up 2FA on their side.

• 7373737373 3y ago
  Or provided their users with randomly generated, secure passwords themselves I saw this idea somewhere on here a few months ago, and since then, granting users the ability to set their own passwords seems like a dumb thing to do!
  • amanaplanacanal 3y ago
    There was a time when random passwords seemed like a bad thing, because users would write them down, and that was an obvious risk. We are way past that of course, but that line of thinking is still informing security decisions.
  • hnlmorg 3y ago
    Depends on what you’re trying to protect against and who your average user is. Forcing passwords onto users is a sure fire way to get people to write their passwords down and constantly get locked out of their account. In some circumstances that’s not a problem. For local domain access, that’s completely unworkable. For websites it makes a little more sense since users can use password reset via email, but if you’re going to expect people to rely on that then you might as well allow them to set a password and use email as 2FA.