2 ms·

I don't really understand the point you're making. Certainly any method can be compromised - I'm not claiming that 2FA can't. In fact, the post you are respondi

I don't really understand the point you're making. Certainly any method can be compromised - I'm not claiming that 2FA can't. In fact, the post you are responding to says ideally, do both. This is sort of why defense in depth is a concept. Even in your example, the 2FA compromise also involves first compromising the password/login credentials.

teeray 2y ago
> In fact, the post you are responding to says ideally, do both Right, I said that even if you do both, both can still be compromised simultaneously and independently. The discussion is more productive if we assume that the password manager can be made secure in the same way that 2FA can be made secure. This returns to my original argument that “assuming a secure password manager with phishing protection, 2fa+password provides no more security than a high entropy password.” Before we go there, this also includes the unstated assumption that the website also leaks only useless information to an attacker (salted hashes that would require centuries to brute force).