3 ms·

Why?

• rekabis 3y ago
  Ignorance, by the looks of it. A password is crackable because it doesn’t change between login attempts. Try guessing often enough, and you whittle down the probability space. 2FA is a moving target, so even with only 6 digits, it remains at a probability of 1/1,000,000 each and every time it challenges the user. Plus, the 2FA “keys” remain in the hands of the valid user, so even if the password gets stolen or sniffed, nothing can happen without the correct 2FA code within a 30-second window. A good password is still a long password, in excess of 16 characters and ideally 32 or more, but a straight password is begging for a world of hurt in today’s security landscape. The only excuse for avoiding 2FA is ignorance, plain and simple. There is just no other way it could possibly be spun. As a security professional, I now _avoid_ services that don’t provide 2FA, because it’s absence indicates they’re morons. Even texting/eMail “2FA” indicates an appalling lack of security awareness these days.