5 ms·
Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?
by drivebyacct2 15y ago
Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?
- loverobots 15y agoYou should clear those cookies quite often. Just saying
- zobzu 15y agoTyping 6 digits every 31 does not add a significant layer of security. 2 factor auth does. And that's different. If one of your devices is stolen, you go reset the pass. As simple as that. Plus, 31 days is a long time for the hacker, so it's not adding all that much security.
- mseebach 15y ago> Plus, 31 days is a long time for the hacker, so it's not adding all that much security. No, but it might well be for the guy who fishes your old harddrive out of a bin.
- dennisgorelik 15y agoIt's extra work. Does this expiration after 31 days add any extra protection?
- josyw 15y agoIt would be nice to choose the level of security you think you can afford on the security-inconvenience tradeoff curve. Especially since it is likely to increase the takeup rate.
- raldi 15y agoTimes two accounts, times four devices, multiple browsers... pretty soon it's a once-a-week frustration.
- abraham 15y agoUse it as a mental improvement exercise to help improve your short term memory.
- jrockway 15y agoI have three accounts and five computers and I don't find the once-a-month 6-digit number to be a big deal. PayPal does annoy me with their policy of requring an OTP seemingly every time you visit a page, but it's worth it because I know that I don't have to have a super-amazing password to stay safe. Ultimately, the work required to recover from a compromised account is much higher than it is to type a 6-digit number every month, so I consider it a good trade-off.
- raldi 15y agoIn my case, the number always seems to expire when my token is far away. So another way of alleviating this would be to have a three day grace period where you're prompted with the option of refreshing your credentials, but you don't have to.
- jrockway 15y agoTheoretically, the printed numbers you keep in your wallet can be used until you get your phone back.
- raldi 15y agoI'm thinking more like, I wake up and want to check my mail from bed, but -- surprise! -- it's expiration day, and my OTP token is downstairs. And using a single recovery code immeditalely invalidates your electronic token, logging you out everywhere and forcing you to go through the activation process all over again before you can log back in.
- raldi 15y agoTyping a six digit number once adds a significant layer of security to a very important account. Having to type it every 31 days (per browser, per device, per account) adds very little marginal security. In fact, in my case it actively hampers security, because it keeps me from using two-factor altogether.