3 ms·
The issue is account hijacking, and it's a matter of tradeoffs: the more relaxed your login process is the more unhappy ex-users you'll have losing their accoun
by jefftk 3y ago
The issue is account hijacking, and it's a matter of tradeoffs: the more relaxed your login process is the more unhappy ex-users you'll have losing their accounts to hackers (mostly reused passwords getting leaked), while the stricter you make it the more unhappy ex-users you'll have losing their accounts to lockouts (mostly stale recovery methods).
- franga2000 3y agoIt's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision. And the answer should never be just "sorry, we can't confirm your identity right now". If I pass every challenge Google throws at me, I should be let into the account, period. If they have more, sure, whatever, let's play the game, but if I did everything right and still can't get in, that's a broken authentication system.
- omnifischer 3y ago> It's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision. If that is your argument then it is their service. They can decide how to offer it. Services like this are designed for majority - and a majority are happy. If you don't prefer then you can find alternate services. Market is wide open.