3 ms·

"You're logging in from a new device. Please check your email for a verification code." "You're logging in from an unusual location. Please answer your securit

by wzdd 3y ago

"You're logging in from a new device. Please check your email for a verification code." "You're logging in from an unusual location. Please answer your security questions to continue." "We've sent you a text message with a code which is valid for the next 10 minutes." "Press OK on the 23andme app to continue." "Please enter the code shown on your 2-factor device." As a user, you can be blamed for poor password practices, but if you're running a service, it's basically a given that some percentage of your users are going to re-use passwords and it's your reponsibility to mitigate the fallout from that. If you don't enforce 2FA then you can check for unusual things about the login, such as change of IP address, browser, or device. Yes, it's not foolproof like 2FA, but it doesn't need to be foolproof to be useful.

Aachen 3y ago
All of these quotes are saying to use 2FA (besides security questions, which are a horrible security measure: https://security.stackexchange.com/a/224271/10863 https://security.stackexchange.com/a/224271/10863). That sounds like a good suggestion, though it costs business because it adds friction. Maybe now that they need to save their reputation, and they're an established business with plenty of customers already, it makes sense for them to add, but a new entrant to the market would simply not do it and I'm not sure whether they can be fully blamed in a competitive market
tzs 3y ago
I'm sure people would complain about most of those on privacy and/or antitrust grounds. > "You're logging in from a new device. Please check your email for a verification code." This site is keeping track of all the devices I use, which is not necessary to provide their service. > "You're logging in from an unusual location. Please answer your security questions to continue." They are also tracking my location, which is not necessary to provide their service. > "We've sent you a text message with a code which is valid for the next 10 minutes." They make me provide a phone number, which is not necessary to provide their service. > "Press OK on the 23andme app to continue." They have a perfectly good web site, yet they require me to use their proprietary app (which requires me to have an Apple or Android phone or tablet). This is not necessary to provide their service. They are probably getting paid by Apple and Google to try to force people to have they devices.

by wzdd 3y ago

Aachen 3y ago

All of these quotes are saying to use 2FA (besides security questions, which are a horrible security measure: https://security.stackexchange.com/a/224271/10863 https://security.stackexchange.com/a/224271/10863). That sounds like a good suggestion, though it costs business because it adds friction. Maybe now that they need to save their reputation, and they're an established business with plenty of customers already, it makes sense for them to add, but a new entrant to the market would simply not do it and I'm not sure whether they can be fully blamed in a competitive market

tzs 3y ago

I'm sure people would complain about most of those on privacy and/or antitrust grounds. > "You're logging in from a new device. Please check your email for a verification code." This site is keeping track of all the devices I use, which is not necessary to provide their service. > "You're logging in from an unusual location. Please answer your security questions to continue." They are also tracking my location, which is not necessary to provide their service. > "We've sent you a text message with a code which is valid for the next 10 minutes." They make me provide a phone number, which is not necessary to provide their service. > "Press OK on the 23andme app to continue." They have a perfectly good web site, yet they require me to use their proprietary app (which requires me to have an Apple or Android phone or tablet). This is not necessary to provide their service. They are probably getting paid by Apple and Google to try to force people to have they devices.