3 ms·
> forced 2FA bullshit... all this makes long term customers want to self host. An objectively positive security feature makes people want to self host?
by richbell 3y ago
> forced 2FA bullshit... all this makes long term customers want to self host.
An objectively positive security feature makes people want to self host?
- contingencies 3y agoI don't trust security people to do sane things. - Linus Torvalds (2017) Specifically, if you have a happy client paying you monthly who has established a functional workflow and no problems, how is forcibly breaking that based on a series of bullshit assumptions (eg. customer has a static phone number in one country that they have continuous SMS access to, customer wants to install your extra app, whatever) for the nominal benefit of some theoretical attack category a smart idea? It's fine to offer the migration, even to encourage it. But to insist is both wrong and bad for business.
- richbell 3y ago> eg. customer has a static phone number in one country that they have continuous SMS access to, customer wants to install your extra app, whatever GitHub uses TOTP which does not require SMS, can be used with dozens of apps (because it's a protocol), and can be easily transfered using QR codes or seeds.
- sgift 3y agoAlso, they support Passkeys. Which is by all metrics a vastly superior way to secure an account compared to normal passwords.