3 ms·

we all do. but it works.

by makach 3y ago

Wowfunhappy 3y ago
So do password managers. Websites concerned about password use should provide an option to use a randomly-generated password (generated by the website, not the user) in leu of MFA. This guarantees the password is unique and complex, and practically ensures that the user has a password manager.
- lucasyvas 3y ago
  I agree in spirit but not in practice. I don't think a website should be trusted to generate a random password - leave that to browser infrastructure (which includes extensions).
  - Wowfunhappy 3y ago
    The idea is that by generating a unique password for the user, the website guarantees that it really is a unique password. How else can you do that? How is this different from the way we handle e.g. api keys?
- arccy 3y ago
  still vulnerable to password db leaks
  - shortrounddev2 3y ago
    Only if you don't hash and salt
jampekka 3y ago
I've never had any of my accounts hacked and my password practices are not great. And for most accounts I don't really care that much if somebody does. I loathe MFA and all this security theatre that makes everything janky.
- makach 3y ago
  Mfa isn’t for us. It’s for everyone else. But I will admit, as someone working professionally as a specialist in the cyber domain, that mfa saved my ass more than once.
stevenicr 3y ago
Until it works too well. I've been consulting with a business on their website, many people have left the company before I got involved.. Godaddy MFA - can't change DNS to new server, no way to renew domain name. What a process to get documents and things together to bypass that - Cloudflare MFA - if I'm at another IP location I can't clear a cache without getting an email to another person and getting codes. I like MFA for bank account type stuff.. and I'm serious about security. However for many things, I would prefer a multi-message that a login has occurred (Send me three emails to different addys and an SMS text) - send me a message that a change has been made, log the ip and changes made. I feel that an sms and email sent to all known things would help with sim swap issues even more than MFA to swap one.. I mean for some things do both - but many things MFA is a drag, especially domain name related stuff that is easy to reverse if a change is detected.

we all do. but it works.

by makach 3y ago

we all do. but it works.

So do password managers. Websites concerned about password use should provide an option to use a randomly-generated password (generated by the website, not the user) in leu of MFA. This guarantees the password is unique and complex, and practically ensures that the user has a password manager.

lucasyvas 3y ago
I agree in spirit but not in practice. I don't think a website should be trusted to generate a random password - leave that to browser infrastructure (which includes extensions).
- Wowfunhappy 3y ago
  The idea is that by generating a unique password for the user, the website guarantees that it really is a unique password. How else can you do that? How is this different from the way we handle e.g. api keys?
arccy 3y ago
still vulnerable to password db leaks
- shortrounddev2 3y ago
  Only if you don't hash and salt

jampekka 3y ago

I've never had any of my accounts hacked and my password practices are not great. And for most accounts I don't really care that much if somebody does. I loathe MFA and all this security theatre that makes everything janky.

makach 3y ago
Mfa isn’t for us. It’s for everyone else. But I will admit, as someone working professionally as a specialist in the cyber domain, that mfa saved my ass more than once.

stevenicr 3y ago

Until it works too well. I've been consulting with a business on their website, many people have left the company before I got involved.. Godaddy MFA - can't change DNS to new server, no way to renew domain name. What a process to get documents and things together to bypass that - Cloudflare MFA - if I'm at another IP location I can't clear a cache without getting an email to another person and getting codes. I like MFA for bank account type stuff.. and I'm serious about security. However for many things, I would prefer a multi-message that a login has occurred (Send me three emails to different addys and an SMS text) - send me a message that a change has been made, log the ip and changes made. I feel that an sms and email sent to all known things would help with sim swap issues even more than MFA to swap one.. I mean for some things do both - but many things MFA is a drag, especially domain name related stuff that is easy to reverse if a change is detected.