3 ms·
> It was your interpretation that I advise people to not use any 2FA at all. No, to be clear, it's the obvious interpretation of a non-expert user, which is wh
by ajross 3y ago
> It was your interpretation that I advise people to not use any 2FA at all.
No, to be clear, it's the obvious interpretation of a non-expert user, which is why your advice is so dangerous. They don't have a yubikey, don't understand how the apps work, and are faced with a decision to either enable SMS 2FA or not. And you're telling them not to, so they won't. And we'll all suffer.
Again, work the other side of the problem if this is important to you. Make the other solutions better and educate people about them. Don't tell them not to use something that might very well save their bank account.
- tialaramex 3y ago> They don't have a yubikey, don't understand how the apps work... But they almost certainly do have a phone, any vaguely modern phone is also a valid hardware credential - and given how much time people spend using a phone it might even be more practical for them. I would argue that the problem is we've made the inconvenience symbolic - people see me sign in at work (with a Yubico Security Key 2 typically) and assume that's some sort of get out or workaround rather than, in reality, the much more secure option that my employer was too cheap to provide. They intuit that the thing they're doing is annoying and takes more effort so logically it must be more secure not less, right ?
- ajross 3y agoOnce more, I'm not saying that SMS 2FA is the best choice. I'm saying it's a vastly better choice than "1FA", and that telling people not to use it is hurting and not helping.
- tialaramex 3y agoAs I stated above because it can cause people to believe they're doing the right thing when they aren't I am actualy not convinced it's necessarily better than nothing.