4 ms·
MFA today is both 'simple' and non-trivial work
- enasterosophes 3y agoThis looks more like a gripe about totp than a critique of MFA in general?
- robertlagrant 3y ago> the simple MFA story invites blaming people (invariably called 'users' when doing this) It's littered with this stuff, but here's one example of silliness. People aren't called users when blaming people. They're called users because they use the software. There's no need to invent perjoratives to make interesting a simple article that restates a known problem. Just state it simply. Or better - get to the point of realising the root problem of this problem, which is also known, and suggest something novel in that regard.
- deleted 3y ago[deleted]
- joeblubaugh 3y ago“What happens if I lose my second factor” is a real problem, but another second factor is probably a better solution than stored recovery tokens. What happens if I forget my password? is the same problem, using your email inbox as a somewhat-secure second factor.
- nomilk 3y agoA damaged or lost 2FA device is less in the control of a cautious and competent user, relative to forgetting a password. Example: taking an Alaska Airlines flight wouldn't typically be considered an account lockout hazard, but this week it was.
- aspenmayer 3y ago> Example: taking an Alaska Airlines flight wouldn't typically be considered an account lockout hazard, but this week it was. Context?
- nomilk 3y agoPassengers’ phones were sucked out when a door fell off mid-flight!
- aspenmayer 3y agoAh, I see. I’m wondering why they mentioned Alaska Airlines when it’s more a Boeing 767 Max issue, hence my confusion.
- Izkata 3y agoA lot of the reporting is using Alaska Airlines, because it was their flight. Also here's one that says "Alaska Airlines MAX 9": https://www.seattletimes.com/business/boeing-aerospace/boeing-is-under-fire-after-alaska-airlines-max-9-blowout-so-is-the-faa/ https://www.seattletimes.com/business/boeing-aerospace/boein...
- aspenmayer 3y ago> A lot of the reporting is using Alaska Airlines, because it was their flight. I don’t disagree, it just wasn’t obvious - to me - what was being referred to originally. I think it’s because lexically/conceptually I don’t associate the issue with any particular airline, as it seems the through line is that they are specifically Boeing planes of a certain series with these issues, and not due to any particular airline or servicing or lack thereof, but rather, a defect in the original design as specified and/or a flaw or oversight in production. Considering the frequency and impact of the issues, I’m inclined to believe it’s a bit of both.
- Ferret7446 3y agoNot really? If a Yubikey in your pocket gets sucked out of a flying plane, you have no problems because you are no longer on the mortal plane.
- Izkata 3y agoApparently peoples' phones flew out of their hands when that happened, which is where most people are keeping their second factor.
- samcat116 3y agoI really can't take pedantic takes like this seriously. Just setup MFA.
- donatj 3y agoI have TOTP basically everywhere. The one place I didn’t have it and specifically didn’t want it was Gmail. My password is over thirty characters long and I know it by heart. I really need access to my gmail even if I break my phone, and that happens every couple years. Usually it falls off my nightstand and I step on it getting out of bed. I also don’t like carrying my phone everywhere. I do now, because I have to, but I shouldn’t have to. Being able to be at a friends house and just check my email on his laptop without carrying a special device seems beyond reasonable. Anyway Google forced me to enable it because I publish a Chrome Extension and I’m still salty about it.
- platz 3y agoyou could memorize the TOTP secrets
- bonton89 3y agoIs it possible to create a second Google account to use just for the Chrome Extension? I've heard that Google will sometimes demand you login from a known device anyway regardless of settings as a form of unexpected 2FA although I haven't experienced it myself.
- remram 3y ago> Being able to be at a friends house and just check my email on his laptop without carrying a special device seems beyond reasonable. That is exactly what MFA is supposed to protect against: other devices being unprotected. Anyway you could look into a physical device like a yubikey that is easier to carry around and harder to break.
- whs 3y agoI heard from some sites long ago that users with 2FA are enthusiast, and disable account recover to prevent social engineering attacks for people who care about security. Today 2FA is the new normal, often mandated by organization. I think it invalidate the previous believe and account recovery should be a configurable option not tied to 2FA.
- dbalatero 3y agoI just store my TOTP/MFA stuff in 1password, along with my username + password. I understand the risks here, but I prefer the tradeoffs vs. putting all my 2fa on a physical device that might get destroyed or stolen. My 1PW vault password is long and secure, and my devices are configured to require it.
- kemotep 3y agoMy ideal future has 100% of my accounts (including bank) supporting passkeys, self-hosted bitwarden with security key for mfa (and backed up keepassxc file with copy of all passkeys and recovery codes stored encrypted in multiple places). Then from any of my devices as long as I have my security key accessible to unlock the vault, I can log into any account using public key cryptography. To get access to the vault you need my strong password, security key, and be on a device with access to the vault or the keepass file (with a different strong password). If I get a new phone or computer, I just need to add bitwarden and access to the network the vault is on and I will be set back up. House could burn down lose all devices including bitwarden host and the backup file would save me.
- syndacks 3y agoI would respectfully disagree. For my Masters in Fine Arts (Creative Writing), I had to write a novel in the style of a dystopic post-modernist. And this was before ChatGPT.
- aspenmayer 3y ago> I had to write a novel in the style of a dystopic post-modernist Mandated by fiat or self-imposed self-flagellation?
- ExoticPearTree 3y agoSounds like a complaint about the lack of a magical solution for MFA backup :)
- deleted 3y ago[deleted]
- greatgib 3y agoWhat is scary is that the current thread is to let Google/Apple clouds and tools to take care of that for you, same as for your passwords.
- donatj 3y agoThis post being flagged is very … curious.