10 ms·

2FA or Not 2FA

74 points by sam_lowry_ 2y ago

Aardwolf 2y ago
Plus many want your phone number or some random app by them on your phone for their 2FA (instead of e.g. TOTP that you contol), less secure because they now can leak your phone number or do something with an update to the app BTW what's the sentiment on passkeys?
- account-5 2y ago
  In my opinion passkeys, whilst solving the password related issues, introduce their own. The risk of losing access to your accounts is greater if you tie everything to one device and that's lost or stolen, and the "solution" to use more than one device is not a solution, or feasible for everyone. There's also the risk of vendor lock-in, which is definitely an aim of the big providers like Apple, Google and Microsoft; which is a bigger risk to those less tech savvy.
  - dcow 2y ago
    FWIW no consumer implementation of passkeys is device bound for exactly this reason. The threat of a user losing a device is much bigger and pressing than getting phished. All passkeys are backed up in a sync fabric.
    - gclawes 2y ago
      You _can_ use a standalone YubiKey or similar dedicated hardware tokens as a passkey, but they have limited slots for discoverable credentials. But yeah, anything resembling a phone passkey seems to have a sync fabric behind it.
    - jampekka 2y ago
      Most consumer passkey implementations are lock-in. https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ https://arstechnica.com/security/2024/12/passkey-technology-...
      - reginald78 2y ago
        And one of the developers of passkeys threatened to use the specified attestation anti-feature to blackball Keepassxc's implementation when they made something not locked in enough. https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 There have been some discussions to create an export standard since then but I remain skeptical. Why was this not part of the original spec but the ban hammer was? Depending upon how this standard is implemented I can easily see it preventing export to anything but Google, Microsoft and Apple's implementations. And it still leaves the attestation badness in place.
        dcow 2y ago
        I was referring to device bound discoverable credentials and saying all implementations that an average Joe will run across have a sync fabric deliberately. Platform lock-in is a different thing. AFAIU the attestation referred to here won’t be signed so any implementation can say anything. It’s just supposed to be ise for things like showing the user a logo so they know where their passkey is stored.
      - dcow 2y ago
        Platform/vendor lock-in != device bound
- red369 2y ago
  Something I don't see talked about often regarding passkeys, is that they seem to be useful in addition to other methods, not instead. I've been thinking that they allow you to have long, non-memorisable unique passwords for an account (1), and then add passkeys on the devices you use often. The long, non-memorisable password isn't inconvenient because you don't need to use it, and the passkeys which are used day to day are resistant to phishing & keyloggers (as I understand). However, I don't know if that is how they're being used or marketed. 1) Perhaps even 2FA too, which wouldn't be as inconvenient if it's only used rarely. Given the points raised in this article, I'm rethinking whether that is necessary.
edent 2y ago
Password re-use is the bigger issue. No one can crack your super-strong multilingual password. But if a service accidentally leaks it, then it doesn't matter. Credential Stuffing is how 23andMe were hacked. People reused password, they were leaked from another service, attackers tried them on a variety of sites until they hit the jackpot. Unique passwords prevent that attack. Can't remember a thousand different passwords? Use a manager. Don't want to use a manager? Switch on 2FA. Weak passwords and password reuse ceases to be a problem. Yes, as the article points out, it slightly reduces ease of login. But that seems like a sensible trade off.
- benoliver999 2y ago
  I would advise against password re-use regardless of 2FA. - Lots of flaky 2FA implementations out there where it's easy to get in without it, if you have the password - If a service doesn't offer 2FA you are now unable to use it for fear of sharing your password (like this website) I suppose logically if your email is 2FA, then someone can't do 'forgot password', but man that feels super flaky.
  - freeone3000 2y ago
    Gmail “magic link” login (which is the reset password flow, but without needing the password) is the same security profile as Google OAuth, while exposing less user data (name and profile are nonoptional) — and also equivalent to an Android-managed passkey.
    - 9dev 2y ago
      With the price being an absolutely awful user experience. Did the email arrive yet? Or wasn’t it sent in the first place? Oh wait, let’s check spam. Send again, what do you mean try again in five minutes, I want to sign in now!
      - benoliver999 2y ago
        It's good UX for websites with extremely long periods between logins. Like a service you access once a year, or even every two years. Or a service where you might never have to log in ever (I run such a thing at work). I would not want this for my google account or the like.
senectus1 2y ago
lol >One of the passwords that I know by heart is a famous classic quote clumsily translated in a mix of French and Dutch. It is long, it can not be brute-forced because of its length and I am pretty sure it is not present in any of the rainbow tables. I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. One keylogger OR phishing attempt and his super complex and secure password is ruined. with no 2FA to protect him.
- akimbostrawman 2y ago
  If a system used for logging in has a keylogger its game over anyways since it could just copy 2FA (excluding hardware token) or cookies.
  - dharmab 2y ago
    2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session cookies are a problem, some services provide a way to invalidate all session cookies, but it's often buried deeply in settings and users aren't aware to find the button after a compromise.
  - echoangle 2y ago
    How would a keylogger steal cookies? There are hardware keyloggers that only record typed text.
    - TeMPOraL 2y ago
      For almost everyone on the planet, being spied on by a hardware keylogger is about as likely to happen as getting eaten by a shark. Security is important, but not the be-all, end-all. People really should get their priorities and threat models straight, and start counting in denial of service and data loss due to security system being incompatible with human beings as a cost.
    - akimbostrawman 2y ago
      Most modern malware are software suits with multiple data extraction feature. Getting a hardware keylogger is extraordinary unlikely and at that point why not also consider video surveillance or evil maid attacks.
_dain_ 2y ago
>Now, my Github access depends on the second factor, which I have chosen to be Microsoft Authenticator running on my phone. I genuinely do not know what will happen if my phone breaks down, so I downloaded TOTP codes from Github and even tried one to see if it works, and so far it does, but now I have one less TOTP code to use in case something happens. Moreover, since Github is now a special case for my password management routine, I am afraid I may loose those TOTP codes and be totally locked out of my account. You don't need a phone for this. You can put the secret key into your password manager and it can generate the TOTP code whenever you need it. KeepassXC and 1Password support it. It stretches the definition of "two-factor" but I don't care; like the author I'm more concerned about phone theft and losing access to everything.
- dandersch 2y ago
  >It stretches the definition of "two-factor" I always considered the time aspect to be the more important "factor" of TOTP in practice. E.g., if somebody managed to peek over your shoulder or film you while typing in your password. With TOTP, they have under a minute to capitalize on that information. I still have that base covered with my password manager handling the secret key, so I never saw the appeal of tying TOTP to a phone.
foreigner 2y ago
This assumes that services are handling your password responsibly and not e.g. storing it in clear text in a public S3 bucket, which in practice happens all the time.
- BlackFly 2y ago
  Actually, the author is assuming that you will generate a password like `Password123!` for an obviously fly-by-night company and use a password manager for other websites of medium trust, the author states as much. My reading of his suggestion is that the memorized passwords are used for things like ssh or possibly logins on laptops/pcs. Some people have a good instinct for such things. This is quite reasonable. - Useless passwords for useless websites that needlessly require accounts. - Autogenerated passwords for websites of infrequent use that you don't need to trust much. - Memorized passwords for logins of high importance that you need to trust. Since we only have so much capacity to memorize a password, the idea of reusing a password for the few high importance logins you have can be quite reasonable.
  - wobfan 2y ago
    I'm just asking myself, why not use the Password generator + manager always if you have it installed either way. I've also used some of my digit-only 8-char passwords for some websites where I'm just indifferent about people logging into my account, but usually I just use the PW manager. It take maybe 1-2 more clicks, but more importantly, it saves me from the website saying "ohhh noooo please add a special character", and then "ohhhh sorry but theres no upper case character", blah blah. By always using the PW manager I have a clear and standard route of registering accounts that is not a lot more work, is way more safe by default, and also can save time if at some point in 2 years you want to log in again, because of some random event. Sure, email reset would be possible, but that takes time again. Another counter-argument against the article in general, at least in my opinion: while 2FA adds a time consuming step to the login, it happens rarely. I use a lot of services and usually always enable 2FA if it has even a single bit of personal or critical data. But as soon as I'm logged in, the access tokens or refresh tokens are valid for such a long time that I rarely have to do the 2FA challenge again.
Tractor8626 2y ago
Author doesn't understand problem space at all. 1) Weak passwords are not ok even on throw-away accounts. Just because you have no use for it, doesn't mean nobody has. Sending spam, or impersonating you or some other creative use. 2) Nobody is going to bruteforce your password. We don't use md5 anymore. You password will get stolen. By phishing, malware, social engineering, password reuse etc.
- einr 2y ago
  By your own argument, if no one is going to bruteforce your password, what then is the issue with a weak password?
  - Jnr 2y ago
    Password lists are full of weak passwords. You don't brute-force the password, you use a password list instead.
    - notpushkin 2y ago
      Potato, potato. Does anybody really say “bruteforce” not meaning a dictionary attack?
      - janalsncm 2y ago
        The author of the article, apparently.
      - Krutonium 2y ago
        Yes, plenty. It's not great for passwords, (but sometimes it still is! Sometimes sites using MD5 still get popped) but there's plenty of other problem spaces where brute forcing still means brute forcing.
        notpushkin 2y ago
        Sorry, forgot to clarify! Yeah, the context matters here: if you’re cracking something like a numeric PIN, or looking for something like a hash collision, you might want to iterate through all possible solutions, randomly or sequentially.
jve 2y ago
> Once I added 2FA to my Github account, it became less secure for me. Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. Why is he mixing stuff he shouldn't? I didn't find a reasonable explanation why 2FA makes things less secure. Not being able to access your account is more secure and not less secure. This article has to do with having a backup plan to access your account and not with security. Or maybe "security" as in "peace of mind". As for Microsoft Authenticator, the data is being backed up and can be restored. Except Microsoft accounts, they require reconfiguration and... is useless to have it backed up and gives false sense of "security" (peace of mind).
- onli 2y ago
  The 2FA adds the risk factor of being locked out. Looking at it that way I'd say it is valid to call that an insecurity. You are right though that this isbabouy having a backup plan. For example, the TOTP app I use supports exporting the logins into a file, which van be saved elsewhere.
daedlanth 2y ago
[dead]
TimJRobinson 2y ago
I thought he was going to mention the stupidity of sites like Twitter that when you add SMS as a 2FA option you can now use that to bypass the password and so are vulnerable to sim hijacking, which given how incompetent phone company employees are makes your security weaker. Always use an authenticator app or physical key, most sites that do SMS 2FA will then allow hackers to use it to bypass knowing your password.
fmajid 2y ago
This is compounded by the fact most 2FA implementations are security theater not phishing-resistant, the sole exception being FIDO2/Webauthn (e.g. Yubikeys), and Passkeys, but passkeys are really single-factor authentication. Both FIDO and passkeys have serious usability challenges, though. What's worse, the most common scheme, SMS-based authentication can lead to denial of service, e.g. you are roaming and do not have access to texts, or have your account SIM-jacked as this seems to be very popular way to steal people's cryptocurrencies.
- _dain_ 2y ago
  >you are roaming and do not have access to texts I truly despise this. It effectively disenfranchises people for living outside of areas with good mobile coverage. Banks or utility payments or parking meters(!) or whatever should not be gated behind cellphone reception. Nevermind people who can't use a phone at all ...
  - l72 2y ago
    I don’t have an international phone plan. When I travel overseas I cannot access my bank account and my primary credit card randomly asks for a phone number verification that I cannot update. I tried buying an sms number from twilio so that I could receive 2fa while out of the country but my bank (PNC) would not accept any phone number unless it was from one of the 4 major carriers in the US! My credit card (capital one) seems to have a phone number on file from Mastercard. If I change my phone number in capital one, whenever I get into the Mastercard extra verification, it does not use the updated number. I have no idea how to get Mastercard to update it. I just ended up using a different credit card!
    - fmajid 2y ago
      I moved from the US to the UK. I ported my US mobile number to Twilio, but that service is incredibly unreliable even for basic things like forwarding a call or a SMS. I had another number on Google Voice, and moved all my US accounts to it whenever possible. The great thing about Google Voice is that since Google doesn't believe in humans providing customer service (or more generally in providing customer service, period), there are no gullible CSRs that can be conned or bribed into SIM-swapping you unlike the mobile carriers.
echoangle 2y ago
> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. Is it though? Wouldn’t that be some kind of safety thing? I think having no way to access the data would be ultimate security, that’s why there’s always a tradeoff between security and usability.
- kalaksi 2y ago
  It is. Confidentiality, integrity, and availability. Edit: see e.g. https://en.wikipedia.org/wiki/Information_security https://en.wikipedia.org/wiki/Information_security
  - echoangle 2y ago
    Interesting. Makes sense if you think about it though, otherwise protecting from ransomware wouldn’t fall under security.
karel-3d 2y ago
> Lately some services started requiring 2FA. One of them is Github. Once I added 2FA to my Github account, it became less secure for me. Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. > > Now, my Github access depends on the second factor, which I have chosen to be Microsoft Authenticator running on my phone. I genuinely do not know what will happen if my phone breaks down, so I downloaded TOTP codes from Github and even tried one to see if it works, and so far it does, but now I have one less TOTP code to use in case something happens. Moreover, since Github is now a special case for my password management routine, I am afraid I may loose those TOTP codes and be totally locked out of my account What? That's not what security means. Sure, you traded convenience for security. Why is this upvoted at all?
- TeMPOraL 2y ago
  Because the current obsession with security is making systems unsafe and unreliable for users, all while trying to get those users more dependent on said systems in their daily lives. What is the biggest risk factor with Google account for me? Is it an attacker guessing my password, impersonating me, stealing my photos? No. It's me breaking my phone, and no longer being able to pass 2FA[0][1]. The second biggest risk? Me typing a wrong comment or YouTube, or doing any other minor transgression against ToS of some Google service, and losing access to everything in one go, with no recourse[2]. Note that literally nothing in meatspace ever requires as careful management over years to decades, as 2FA does. There is always a recovery procedure. You may need to stop by the court or a notary, but no matter the fuckup, you can always recover access - to everything except modern Internet services. -- [0] - Yes, I have the security codes I generated 15+ years ago; I have them on paper, somewhere. Like most people, I suck at keeping small paper documents accessible and available over years. [1] - Also yes, I did break my phone, and I survived this without data loss only because I had a complex setup around Pebble and Tasker, that allowed me to operate the phone with non-functioning screen remotely to the point I could mirror the display to the computer and continue from then. Most people in most situations can't do that. [2] - Other than complaining on HN and hoping some Googler will advocate internally for me - which, as far as I know, they're explicitly not allowed to do, and it's a career-risking move.
- 2y ago
latexr 2y ago
> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. This felt like the author bending over backwards to justify their choice. They find 2FA less convenient and conflate it with being less secure. It’s not the same thing. It’s OK to say “not all my accounts are equally important and I need to access some of them in situations where 2FA and complex passwords aren’t worth it”. It’s not OK to sell the idea that 2FA does not generally offer security. This reminded me of the “SEO expert” a few years back which was trying to convince everyone, with wrong information, to not use HTTPS (which, I realise only after writing this, the author’s website also doesn’t use).
- guappa 2y ago
  If we define data that can't be accessed by anyone as secure, throwing disks in a furnace is how you achieve security. I don't think this definition is very helpful though. So I prefer the one where the entities that need to have access still can access.
  - latexr 2y ago
    > I don't think this definition is very helpful though. Because it’s a straw man, and straw men aren’t helpful for discussion. No one is suggesting making data wholly inaccessible. Data that you cannot access “at any time and in any circumstances” (author’s words) can still be secure. A fairer analogy would have been storing disks in a locked safe in your home. It’s not as convenient to access it, but it is secure. Should you do that for all your data? No, but neither have I advocated for that. I very clearly stated that I think it’s OK to have different levels of protection for different types of data.
- mouse_ 2y ago
  If I can't access money that I secured, I didn't secure it properly.
  - latexr 2y ago
    Which has nothing to do with my argument. See the reply to the other user, which expands. https://news.ycombinator.com/item?id=43421721 https://news.ycombinator.com/item?id=43421721
seethishat 2y ago
For the author... you may export/backup the TOTP secret from the TOTP app (MS Authenticator in this example) and save that someplace secure. You may use any TOTP app with that secret to generate codes to log in. I typically do this as a safe guard in case the device that is running the TOTP app breaks or fails in some way. I'm old enough and my passwords are random enough that I don't worry about them being guessed. However, I do worry about web security in general and the fact that companies are basically black boxes with loads of young inexperienced developers. They may be storing our passwords as plaintext strings and have them in a public S3 bucket. But, if you want one of my YubiKeys, you'd have to find me and physically steal it from me and hope I don't notice. So there are some useful things with regard to 2FA.
bradley13 2y ago
He's not wrong. I use a password manager that stores passwords only locally, not in the cloud. I can generate arbitrarily complex passwords and never have to worry about how hard they are to type or remember. 2FA makes my workflow significantly more difficult. As a result, for non-critical sites, I have started allowing the browser to store my passwords, thus relying on the 2FA-authenticator for security. This result is likely less secure overall, since the browser's password storage could realistically be compromised. That said, I do have to acknowledge the point in another comment that phishing may be the bigger threat. Log into a fake site with a password but no 2FA, and you are toast.
- postalrat 2y ago
  What is the difference between a secure password synced with a password manager and a cookie that doesn't expire synced with a browser or extension? I don't see much difference so why bother even having a password?
  - megous 2y ago
    The difference is that cookies are not even encrypted and you can get all of them by `sqlite3 .dump` on `cookies.sqlite` file, while password manager likely offers more protection, since that's the point of it. :D Also SID are ephemeral and expire, while passwords are not supposed to be. Session IDs may be tied by the backend to a client IP address, or some such, but likely that's not done very often, and may not be that useful.
    - postalrat 2y ago
      In this case the cookie would be as permanent as a password. I was just thinking if convenience is a priority why even have a password when the cookie is just as secure.
  - 9dev 2y ago
    What if your cookie is compromised and you want to ensure the attacker cannot log into your account anymore?
apples_oranges 2y ago
Off topic: This is a website without HTTPS
- red369 2y ago
  Interested in your thoughts (and anyone else's) - is this OK for a website just serving content for consumption only, without logins, forms, etc? Would people rather that no-one can MITM and see which articles they read on the site? Or is it about conditioning people do demand HTTPS so that it's there when they need it? BTW: I feel I might be missing the real issues or unintentionally straw-manned them.
  - koakuma-chan 2y ago
    It's not just about seeing, a man in the middle could also modify the content.
jesprenj 2y ago
I think that 2FA is widely required not to protect users of online services but to protect the services themselves and/or their administrators from a burden of annoying work. Users that create accounts with weak passwords because they don't care about their accounts present a problem for the company behind the service, because their accounts will eventually become used as puppets of spammers etc. By requiring a very complicated login procedure, spammers won't try to hack those unused accounts and exploit them, resulting in less email being sent to abuse@. And I think that's the most probable reason 2FA is _required_ today on most online services.
- dcow 2y ago
  Nailed it. 2FA is about businesses doing risk management.
donohoe 2y ago
It’s hard to take this advice from someone who’s site doesn’t even support HTTPS.
- jampekka 2y ago
  HTTPS isn't very critical for a static site. Only the Sith, and security zealots, deal in absolutes.
  - SahAssar 2y ago
    HTTPS protects the integrity and confidentiality (to a certain point, see ESNI) of what you visit. Those are important even if you don't submit any additional data to the server. Disclaimer: I'm not a sith or a security zealot.
    - sam_lowry_ 2y ago
      HTTPS everywhere also makes internet less decentralized. This is even more important.
xpil 2y ago
I've noticed another issue: 2FA software fragmentation. Over the past 30 years, I've accumulated more than 600 online accounts (many of them dormant), with about 25-30% offering 2FA. As a result, I now have three separate apps for generating codes. I could consolidate them into one, but, frankly, I'm too lazy. So instead, I often find myself scrambling between different 2FA apps and devices just to locate the right account.
perlgeek 2y ago
There are really two aspects two 2FA: 1: you as a user might want to protect your account 2: A website provider wants to secure their own business If it's about 1, then the argument "I don't reuse passwords" hold some water. It doesn't protect you from somebody getting access to a plaintext copy of your requests (for example on the load balancer that terminates the TLS), but that's only a small part of potential attack surfaces. But from the perspective the website owner, they might suspect that many of their users reuse passwords between sites. 2FA is a great defense against that, and also against brute force attempts.
PinguTS 2y ago
There is another issue with all those growing 2FA/MFA protected accounts: managing your unexpected death. How do you teach your beloved ones to access your accounts. And they need to remember what to do. For some accounts may it doesn't matter. For others that means to be able to end the subscription. Because not all subscriptions are associated with a credit card, which just expires. But if you allow to contact a company by a third party to cancel and or change things then this becomes the go to for social engineering.
- croes 2y ago
  Isn’t the device to access the password manager mostly the same device used for 2FA? I hope most people use a password manager.
  - dewey 2y ago
    Most people are just storing them in the browser but that’s not stopping people from coming up with easy to guess passwords.
- pests 2y ago
  Services like FB have the concept of a legacy contact, an account that can manage your page after death. Also the concept of your profile switching to a memorial page, with your legacy contact doing moderation of posts. I did the math years ago and even back then, thousands of users would pass daily and now with most of the world population on FB it probably comes in handy.
- bobbiechen 2y ago
  In the US, you have a legal right to access accounts of the deceased through RUFADAA. It's not as simple as logging in (usually requires a court order) but it's possible. I wrote about it and related issues here: https://digitalseams.com/blog/what-happens-to-your-online-accounts-when-you-die https://digitalseams.com/blog/what-happens-to-your-online-ac... (and recently discussed on HN: https://news.ycombinator.com/item?id=42991112 https://news.ycombinator.com/item?id=42991112)
1970-01-01 2y ago
OLD NEWS: Something you have. Something you know. Something you are. Pick two. NEW: Dismiss anything that is a hybridization. That is 1.5FA It's 2025. 0-days are rampant. If you're not at 2.0FA, you're at a high risk of getting popped.
alwayslikethis 2y ago
I wish sites offered a way to opt out of 2FA if your password has enough entropy (128 bit random string). These are not getting cracked anytime soon. I store my TOTPs in keepassxc with the other passwords anyway. The keepassxc database is the "something you have" and its password is "something you know", and the random string is a testament to that. Also stop forcing SMS 2FA please. I don't want to need to have a phone.
- anfilt 2y ago
  I agree although sites still might concerned about password re-use they could just have an option to generate what is basically a key. Instead of a password and some sort 2fa "token" which is basicallly a key. Accept for that 2fa token only a low amount the entropy is capable of generating is used. I also agree sms 2fa is just broken/garbage.
evolve2k 2y ago
> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can break into my ssh account or gmail account protected by such a password. Oh dear. The issue isn’t the brute force, it’s that the online services leak and get cracked. And in an instant a single script takes the newly discovered username password combo and starts hammering it into the top 10000 websites, all within moments of the leak data becoming available. Your super secret favourite phrase is worth crap once leaked alongside your email address. Further don’t choose Microsoft for your Auth app, Go with an open source option, maybe one that encrypts and syncs so you have multiple devices just in case.
- ajd555 2y ago
  I could not agree more with this comment. OP entirely misses the point of 2FA. I sleep so much better at night knowing that I have different passwords for every account, and 2FA where possible. One should not write about 2FA when one uses the same "uncrackable" password everywhere...
  - autoexec 2y ago
    Maybe I missed it (it's early and I haven't even had coffee yet) but where did the author say they resued the same password over multiple sites?
- femtozer 2y ago
  Not sure I understand — passwords are generally hashed in databases. Even if leaked, an attacker would still need to brute-force the hash to retrieve the actual password, wouldn’t they?
  - evolve2k 2y ago
    You’d think so. But over and over plain text leaks of passwords is the practical reality of the modern internet. A disgruntled staff member, poor tech practices or someone working out a way to get in and get access. The https://haveibeenpwned.com/ https://haveibeenpwned.com/ project regularly shares new breached datasets. Reusing passwords across websites without MFA is just not not not recommended in 2025.
megous 2y ago
> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can break into my ssh account or gmail account protected by such a password. SSH... no, they can't. Gmail... yes, you're basically giving your password in plaintext to someone on the internet. I dislike 2FA for similar reasons, but I would rigorously segregate remembered passwords between those shared with some service, and those used locally.
gibibit 2y ago
I agree with the article. Maybe businesses are trying to protect themselves, but as a user, mandatory 2FA reduces the level of security I can achieve for myself. Because security is not just confidentiality, it's also availability: the "Security CIA Triad" is Confidentiality, Integrity, and Availability. If I can lose access (availability) to my online account by losing some physical item (e.g. lost cell phone), or if some third party can prevent me from accessing my 2FA (e.g. banned from my email provider by DMCA takedown request), then I have my availability, and hence overall security is at risk. Additionally, requiring a phone number for online services means that the confidentiality of my identity is reduced. It becomes impossible to be anonymous. For instance, you can't use Signal messenger without a phone number, so there's a chance your identity can be leaked.
gpi 2y ago
Can't seem to access the site over https.
jackman3005 2y ago
1password for unique long passwords per account. I store OTP in 1password as well for the extreme convenience it offers on desktop & mobile. Backup TOTP are put in .txt files for each service and in a folder encrypted by Cryptomator (using a unique pw not used by any other services, esp. 1password). This encrypted folder is put on flash drive on my keychain and synced into my google drive folder. This feels to me like a pretty good balance between convenience and security. Not 100% of my eggs are in one basket, but it's true that my 1password account password needs to be long and well-guarded and never re-used for anything else. Also putting a lot of trust into 1password to not get breached...
- prima-facie 2y ago
  > Backup TOTP are put in .txt files for each service and in a folder encrypted by Cryptomator I do something similar but instead use KeePassXC to securely store copies of totp secrets.
eternityforest 2y ago
I know lots of people who have been hacked with passwords... If you reuse it, it gets leaked, if you don't reuse it, it's very hard to remember all your 74653 different accounts. And some of us don't have reliable muscle memory... Having our SSH password suddenly vanish would be undesirable.
wisdomalfred 2y ago
[dead]

74 points by sam_lowry_ 2y ago

Plus many want your phone number or some random app by them on your phone for their 2FA (instead of e.g. TOTP that you contol), less secure because they now can leak your phone number or do something with an update to the app BTW what's the sentiment on passkeys?

account-5 2y ago
In my opinion passkeys, whilst solving the password related issues, introduce their own. The risk of losing access to your accounts is greater if you tie everything to one device and that's lost or stolen, and the "solution" to use more than one device is not a solution, or feasible for everyone. There's also the risk of vendor lock-in, which is definitely an aim of the big providers like Apple, Google and Microsoft; which is a bigger risk to those less tech savvy.
- dcow 2y ago
  FWIW no consumer implementation of passkeys is device bound for exactly this reason. The threat of a user losing a device is much bigger and pressing than getting phished. All passkeys are backed up in a sync fabric.
  - gclawes 2y ago
    You _can_ use a standalone YubiKey or similar dedicated hardware tokens as a passkey, but they have limited slots for discoverable credentials. But yeah, anything resembling a phone passkey seems to have a sync fabric behind it.
  - jampekka 2y ago
    Most consumer passkey implementations are lock-in. https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ https://arstechnica.com/security/2024/12/passkey-technology-...
    - reginald78 2y ago
      And one of the developers of passkeys threatened to use the specified attestation anti-feature to blackball Keepassxc's implementation when they made something not locked in enough. https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 There have been some discussions to create an export standard since then but I remain skeptical. Why was this not part of the original spec but the ban hammer was? Depending upon how this standard is implemented I can easily see it preventing export to anything but Google, Microsoft and Apple's implementations. And it still leaves the attestation badness in place.
      - dcow 2y ago
        I was referring to device bound discoverable credentials and saying all implementations that an average Joe will run across have a sync fabric deliberately. Platform lock-in is a different thing. AFAIU the attestation referred to here won’t be signed so any implementation can say anything. It’s just supposed to be ise for things like showing the user a logo so they know where their passkey is stored.
    - dcow 2y ago
      Platform/vendor lock-in != device bound
red369 2y ago
Something I don't see talked about often regarding passkeys, is that they seem to be useful in addition to other methods, not instead. I've been thinking that they allow you to have long, non-memorisable unique passwords for an account (1), and then add passkeys on the devices you use often. The long, non-memorisable password isn't inconvenient because you don't need to use it, and the passkeys which are used day to day are resistant to phishing & keyloggers (as I understand). However, I don't know if that is how they're being used or marketed. 1) Perhaps even 2FA too, which wouldn't be as inconvenient if it's only used rarely. Given the points raised in this article, I'm rethinking whether that is necessary.

edent 2y ago

Password re-use is the bigger issue. No one can crack your super-strong multilingual password. But if a service accidentally leaks it, then it doesn't matter. Credential Stuffing is how 23andMe were hacked. People reused password, they were leaked from another service, attackers tried them on a variety of sites until they hit the jackpot. Unique passwords prevent that attack. Can't remember a thousand different passwords? Use a manager. Don't want to use a manager? Switch on 2FA. Weak passwords and password reuse ceases to be a problem. Yes, as the article points out, it slightly reduces ease of login. But that seems like a sensible trade off.

benoliver999 2y ago
I would advise against password re-use regardless of 2FA. - Lots of flaky 2FA implementations out there where it's easy to get in without it, if you have the password - If a service doesn't offer 2FA you are now unable to use it for fear of sharing your password (like this website) I suppose logically if your email is 2FA, then someone can't do 'forgot password', but man that feels super flaky.
- freeone3000 2y ago
  Gmail “magic link” login (which is the reset password flow, but without needing the password) is the same security profile as Google OAuth, while exposing less user data (name and profile are nonoptional) — and also equivalent to an Android-managed passkey.
  - 9dev 2y ago
    With the price being an absolutely awful user experience. Did the email arrive yet? Or wasn’t it sent in the first place? Oh wait, let’s check spam. Send again, what do you mean try again in five minutes, I want to sign in now!
    - benoliver999 2y ago
      It's good UX for websites with extremely long periods between logins. Like a service you access once a year, or even every two years. Or a service where you might never have to log in ever (I run such a thing at work). I would not want this for my google account or the like.

senectus1 2y ago

lol >One of the passwords that I know by heart is a famous classic quote clumsily translated in a mix of French and Dutch. It is long, it can not be brute-forced because of its length and I am pretty sure it is not present in any of the rainbow tables. I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. One keylogger OR phishing attempt and his super complex and secure password is ruined. with no 2FA to protect him.

akimbostrawman 2y ago
If a system used for logging in has a keylogger its game over anyways since it could just copy 2FA (excluding hardware token) or cookies.
- dharmab 2y ago
  2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session cookies are a problem, some services provide a way to invalidate all session cookies, but it's often buried deeply in settings and users aren't aware to find the button after a compromise.
- echoangle 2y ago
  How would a keylogger steal cookies? There are hardware keyloggers that only record typed text.
  - TeMPOraL 2y ago
    For almost everyone on the planet, being spied on by a hardware keylogger is about as likely to happen as getting eaten by a shark. Security is important, but not the be-all, end-all. People really should get their priorities and threat models straight, and start counting in denial of service and data loss due to security system being incompatible with human beings as a cost.
  - akimbostrawman 2y ago
    Most modern malware are software suits with multiple data extraction feature. Getting a hardware keylogger is extraordinary unlikely and at that point why not also consider video surveillance or evil maid attacks.

_dain_ 2y ago

>Now, my Github access depends on the second factor, which I have chosen to be Microsoft Authenticator running on my phone. I genuinely do not know what will happen if my phone breaks down, so I downloaded TOTP codes from Github and even tried one to see if it works, and so far it does, but now I have one less TOTP code to use in case something happens. Moreover, since Github is now a special case for my password management routine, I am afraid I may loose those TOTP codes and be totally locked out of my account. You don't need a phone for this. You can put the secret key into your password manager and it can generate the TOTP code whenever you need it. KeepassXC and 1Password support it. It stretches the definition of "two-factor" but I don't care; like the author I'm more concerned about phone theft and losing access to everything.

dandersch 2y ago
>It stretches the definition of "two-factor" I always considered the time aspect to be the more important "factor" of TOTP in practice. E.g., if somebody managed to peek over your shoulder or film you while typing in your password. With TOTP, they have under a minute to capitalize on that information. I still have that base covered with my password manager handling the secret key, so I never saw the appeal of tying TOTP to a phone.

foreigner 2y ago

This assumes that services are handling your password responsibly and not e.g. storing it in clear text in a public S3 bucket, which in practice happens all the time.

BlackFly 2y ago
Actually, the author is assuming that you will generate a password like `Password123!` for an obviously fly-by-night company and use a password manager for other websites of medium trust, the author states as much. My reading of his suggestion is that the memorized passwords are used for things like ssh or possibly logins on laptops/pcs. Some people have a good instinct for such things. This is quite reasonable. - Useless passwords for useless websites that needlessly require accounts. - Autogenerated passwords for websites of infrequent use that you don't need to trust much. - Memorized passwords for logins of high importance that you need to trust. Since we only have so much capacity to memorize a password, the idea of reusing a password for the few high importance logins you have can be quite reasonable.
- wobfan 2y ago
  I'm just asking myself, why not use the Password generator + manager always if you have it installed either way. I've also used some of my digit-only 8-char passwords for some websites where I'm just indifferent about people logging into my account, but usually I just use the PW manager. It take maybe 1-2 more clicks, but more importantly, it saves me from the website saying "ohhh noooo please add a special character", and then "ohhhh sorry but theres no upper case character", blah blah. By always using the PW manager I have a clear and standard route of registering accounts that is not a lot more work, is way more safe by default, and also can save time if at some point in 2 years you want to log in again, because of some random event. Sure, email reset would be possible, but that takes time again. Another counter-argument against the article in general, at least in my opinion: while 2FA adds a time consuming step to the login, it happens rarely. I use a lot of services and usually always enable 2FA if it has even a single bit of personal or critical data. But as soon as I'm logged in, the access tokens or refresh tokens are valid for such a long time that I rarely have to do the 2FA challenge again.

Tractor8626 2y ago

Author doesn't understand problem space at all. 1) Weak passwords are not ok even on throw-away accounts. Just because you have no use for it, doesn't mean nobody has. Sending spam, or impersonating you or some other creative use. 2) Nobody is going to bruteforce your password. We don't use md5 anymore. You password will get stolen. By phishing, malware, social engineering, password reuse etc.

einr 2y ago
By your own argument, if no one is going to bruteforce your password, what then is the issue with a weak password?
- Jnr 2y ago
  Password lists are full of weak passwords. You don't brute-force the password, you use a password list instead.
  - notpushkin 2y ago
    Potato, potato. Does anybody really say “bruteforce” not meaning a dictionary attack?
    - janalsncm 2y ago
      The author of the article, apparently.
    - Krutonium 2y ago
      Yes, plenty. It's not great for passwords, (but sometimes it still is! Sometimes sites using MD5 still get popped) but there's plenty of other problem spaces where brute forcing still means brute forcing.
      - notpushkin 2y ago
        Sorry, forgot to clarify! Yeah, the context matters here: if you’re cracking something like a numeric PIN, or looking for something like a hash collision, you might want to iterate through all possible solutions, randomly or sequentially.

jve 2y ago

> Once I added 2FA to my Github account, it became less secure for me. Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. Why is he mixing stuff he shouldn't? I didn't find a reasonable explanation why 2FA makes things less secure. Not being able to access your account is more secure and not less secure. This article has to do with having a backup plan to access your account and not with security. Or maybe "security" as in "peace of mind". As for Microsoft Authenticator, the data is being backed up and can be restored. Except Microsoft accounts, they require reconfiguration and... is useless to have it backed up and gives false sense of "security" (peace of mind).

onli 2y ago
The 2FA adds the risk factor of being locked out. Looking at it that way I'd say it is valid to call that an insecurity. You are right though that this isbabouy having a backup plan. For example, the TOTP app I use supports exporting the logins into a file, which van be saved elsewhere.

daedlanth 2y ago

[dead]

TimJRobinson 2y ago

I thought he was going to mention the stupidity of sites like Twitter that when you add SMS as a 2FA option you can now use that to bypass the password and so are vulnerable to sim hijacking, which given how incompetent phone company employees are makes your security weaker. Always use an authenticator app or physical key, most sites that do SMS 2FA will then allow hackers to use it to bypass knowing your password.

fmajid 2y ago

This is compounded by the fact most 2FA implementations are security theater not phishing-resistant, the sole exception being FIDO2/Webauthn (e.g. Yubikeys), and Passkeys, but passkeys are really single-factor authentication. Both FIDO and passkeys have serious usability challenges, though. What's worse, the most common scheme, SMS-based authentication can lead to denial of service, e.g. you are roaming and do not have access to texts, or have your account SIM-jacked as this seems to be very popular way to steal people's cryptocurrencies.

_dain_ 2y ago
>you are roaming and do not have access to texts I truly despise this. It effectively disenfranchises people for living outside of areas with good mobile coverage. Banks or utility payments or parking meters(!) or whatever should not be gated behind cellphone reception. Nevermind people who can't use a phone at all ...
- l72 2y ago
  I don’t have an international phone plan. When I travel overseas I cannot access my bank account and my primary credit card randomly asks for a phone number verification that I cannot update. I tried buying an sms number from twilio so that I could receive 2fa while out of the country but my bank (PNC) would not accept any phone number unless it was from one of the 4 major carriers in the US! My credit card (capital one) seems to have a phone number on file from Mastercard. If I change my phone number in capital one, whenever I get into the Mastercard extra verification, it does not use the updated number. I have no idea how to get Mastercard to update it. I just ended up using a different credit card!
  - fmajid 2y ago
    I moved from the US to the UK. I ported my US mobile number to Twilio, but that service is incredibly unreliable even for basic things like forwarding a call or a SMS. I had another number on Google Voice, and moved all my US accounts to it whenever possible. The great thing about Google Voice is that since Google doesn't believe in humans providing customer service (or more generally in providing customer service, period), there are no gullible CSRs that can be conned or bribed into SIM-swapping you unlike the mobile carriers.

echoangle 2y ago

> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. Is it though? Wouldn’t that be some kind of safety thing? I think having no way to access the data would be ultimate security, that’s why there’s always a tradeoff between security and usability.

kalaksi 2y ago
It is. Confidentiality, integrity, and availability. Edit: see e.g. https://en.wikipedia.org/wiki/Information_security https://en.wikipedia.org/wiki/Information_security
- echoangle 2y ago
  Interesting. Makes sense if you think about it though, otherwise protecting from ransomware wouldn’t fall under security.

karel-3d 2y ago

> Lately some services started requiring 2FA. One of them is Github. Once I added 2FA to my Github account, it became less secure for me. Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. > > Now, my Github access depends on the second factor, which I have chosen to be Microsoft Authenticator running on my phone. I genuinely do not know what will happen if my phone breaks down, so I downloaded TOTP codes from Github and even tried one to see if it works, and so far it does, but now I have one less TOTP code to use in case something happens. Moreover, since Github is now a special case for my password management routine, I am afraid I may loose those TOTP codes and be totally locked out of my account What? That's not what security means. Sure, you traded convenience for security. Why is this upvoted at all?

TeMPOraL 2y ago
Because the current obsession with security is making systems unsafe and unreliable for users, all while trying to get those users more dependent on said systems in their daily lives. What is the biggest risk factor with Google account for me? Is it an attacker guessing my password, impersonating me, stealing my photos? No. It's me breaking my phone, and no longer being able to pass 2FA[0][1]. The second biggest risk? Me typing a wrong comment or YouTube, or doing any other minor transgression against ToS of some Google service, and losing access to everything in one go, with no recourse[2]. Note that literally nothing in meatspace ever requires as careful management over years to decades, as 2FA does. There is always a recovery procedure. You may need to stop by the court or a notary, but no matter the fuckup, you can always recover access - to everything except modern Internet services. -- [0] - Yes, I have the security codes I generated 15+ years ago; I have them on paper, somewhere. Like most people, I suck at keeping small paper documents accessible and available over years. [1] - Also yes, I did break my phone, and I survived this without data loss only because I had a complex setup around Pebble and Tasker, that allowed me to operate the phone with non-functioning screen remotely to the point I could mirror the display to the computer and continue from then. Most people in most situations can't do that. [2] - Other than complaining on HN and hoping some Googler will advocate internally for me - which, as far as I know, they're explicitly not allowed to do, and it's a career-risking move.
2y ago

latexr 2y ago

> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. This felt like the author bending over backwards to justify their choice. They find 2FA less convenient and conflate it with being less secure. It’s not the same thing. It’s OK to say “not all my accounts are equally important and I need to access some of them in situations where 2FA and complex passwords aren’t worth it”. It’s not OK to sell the idea that 2FA does not generally offer security. This reminded me of the “SEO expert” a few years back which was trying to convince everyone, with wrong information, to not use HTTPS (which, I realise only after writing this, the author’s website also doesn’t use).

guappa 2y ago
If we define data that can't be accessed by anyone as secure, throwing disks in a furnace is how you achieve security. I don't think this definition is very helpful though. So I prefer the one where the entities that need to have access still can access.
- latexr 2y ago
  > I don't think this definition is very helpful though. Because it’s a straw man, and straw men aren’t helpful for discussion. No one is suggesting making data wholly inaccessible. Data that you cannot access “at any time and in any circumstances” (author’s words) can still be secure. A fairer analogy would have been storing disks in a locked safe in your home. It’s not as convenient to access it, but it is secure. Should you do that for all your data? No, but neither have I advocated for that. I very clearly stated that I think it’s OK to have different levels of protection for different types of data.
mouse_ 2y ago
If I can't access money that I secured, I didn't secure it properly.
- latexr 2y ago
  Which has nothing to do with my argument. See the reply to the other user, which expands. https://news.ycombinator.com/item?id=43421721 https://news.ycombinator.com/item?id=43421721

seethishat 2y ago

For the author... you may export/backup the TOTP secret from the TOTP app (MS Authenticator in this example) and save that someplace secure. You may use any TOTP app with that secret to generate codes to log in. I typically do this as a safe guard in case the device that is running the TOTP app breaks or fails in some way. I'm old enough and my passwords are random enough that I don't worry about them being guessed. However, I do worry about web security in general and the fact that companies are basically black boxes with loads of young inexperienced developers. They may be storing our passwords as plaintext strings and have them in a public S3 bucket. But, if you want one of my YubiKeys, you'd have to find me and physically steal it from me and hope I don't notice. So there are some useful things with regard to 2FA.

bradley13 2y ago

He's not wrong. I use a password manager that stores passwords only locally, not in the cloud. I can generate arbitrarily complex passwords and never have to worry about how hard they are to type or remember. 2FA makes my workflow significantly more difficult. As a result, for non-critical sites, I have started allowing the browser to store my passwords, thus relying on the 2FA-authenticator for security. This result is likely less secure overall, since the browser's password storage could realistically be compromised. That said, I do have to acknowledge the point in another comment that phishing may be the bigger threat. Log into a fake site with a password but no 2FA, and you are toast.

postalrat 2y ago
What is the difference between a secure password synced with a password manager and a cookie that doesn't expire synced with a browser or extension? I don't see much difference so why bother even having a password?
- megous 2y ago
  The difference is that cookies are not even encrypted and you can get all of them by `sqlite3 .dump` on `cookies.sqlite` file, while password manager likely offers more protection, since that's the point of it. :D Also SID are ephemeral and expire, while passwords are not supposed to be. Session IDs may be tied by the backend to a client IP address, or some such, but likely that's not done very often, and may not be that useful.
  - postalrat 2y ago
    In this case the cookie would be as permanent as a password. I was just thinking if convenience is a priority why even have a password when the cookie is just as secure.
- 9dev 2y ago
  What if your cookie is compromised and you want to ensure the attacker cannot log into your account anymore?

apples_oranges 2y ago

Off topic: This is a website without HTTPS

red369 2y ago
Interested in your thoughts (and anyone else's) - is this OK for a website just serving content for consumption only, without logins, forms, etc? Would people rather that no-one can MITM and see which articles they read on the site? Or is it about conditioning people do demand HTTPS so that it's there when they need it? BTW: I feel I might be missing the real issues or unintentionally straw-manned them.
- koakuma-chan 2y ago
  It's not just about seeing, a man in the middle could also modify the content.

jesprenj 2y ago

I think that 2FA is widely required not to protect users of online services but to protect the services themselves and/or their administrators from a burden of annoying work. Users that create accounts with weak passwords because they don't care about their accounts present a problem for the company behind the service, because their accounts will eventually become used as puppets of spammers etc. By requiring a very complicated login procedure, spammers won't try to hack those unused accounts and exploit them, resulting in less email being sent to abuse@. And I think that's the most probable reason 2FA is _required_ today on most online services.

dcow 2y ago
Nailed it. 2FA is about businesses doing risk management.

donohoe 2y ago

It’s hard to take this advice from someone who’s site doesn’t even support HTTPS.

jampekka 2y ago
HTTPS isn't very critical for a static site. Only the Sith, and security zealots, deal in absolutes.
- SahAssar 2y ago
  HTTPS protects the integrity and confidentiality (to a certain point, see ESNI) of what you visit. Those are important even if you don't submit any additional data to the server. Disclaimer: I'm not a sith or a security zealot.
  - sam_lowry_ 2y ago
    HTTPS everywhere also makes internet less decentralized. This is even more important.

xpil 2y ago

I've noticed another issue: 2FA software fragmentation. Over the past 30 years, I've accumulated more than 600 online accounts (many of them dormant), with about 25-30% offering 2FA. As a result, I now have three separate apps for generating codes. I could consolidate them into one, but, frankly, I'm too lazy. So instead, I often find myself scrambling between different 2FA apps and devices just to locate the right account.

perlgeek 2y ago

There are really two aspects two 2FA: 1: you as a user might want to protect your account 2: A website provider wants to secure their own business If it's about 1, then the argument "I don't reuse passwords" hold some water. It doesn't protect you from somebody getting access to a plaintext copy of your requests (for example on the load balancer that terminates the TLS), but that's only a small part of potential attack surfaces. But from the perspective the website owner, they might suspect that many of their users reuse passwords between sites. 2FA is a great defense against that, and also against brute force attempts.

PinguTS 2y ago

There is another issue with all those growing 2FA/MFA protected accounts: managing your unexpected death. How do you teach your beloved ones to access your accounts. And they need to remember what to do. For some accounts may it doesn't matter. For others that means to be able to end the subscription. Because not all subscriptions are associated with a credit card, which just expires. But if you allow to contact a company by a third party to cancel and or change things then this becomes the go to for social engineering.

croes 2y ago
Isn’t the device to access the password manager mostly the same device used for 2FA? I hope most people use a password manager.
- dewey 2y ago
  Most people are just storing them in the browser but that’s not stopping people from coming up with easy to guess passwords.
pests 2y ago
Services like FB have the concept of a legacy contact, an account that can manage your page after death. Also the concept of your profile switching to a memorial page, with your legacy contact doing moderation of posts. I did the math years ago and even back then, thousands of users would pass daily and now with most of the world population on FB it probably comes in handy.
bobbiechen 2y ago
In the US, you have a legal right to access accounts of the deceased through RUFADAA. It's not as simple as logging in (usually requires a court order) but it's possible. I wrote about it and related issues here: https://digitalseams.com/blog/what-happens-to-your-online-accounts-when-you-die https://digitalseams.com/blog/what-happens-to-your-online-ac... (and recently discussed on HN: https://news.ycombinator.com/item?id=42991112 https://news.ycombinator.com/item?id=42991112)

1970-01-01 2y ago

OLD NEWS: Something you have. Something you know. Something you are. Pick two. NEW: Dismiss anything that is a hybridization. That is 1.5FA It's 2025. 0-days are rampant. If you're not at 2.0FA, you're at a high risk of getting popped.

alwayslikethis 2y ago

I wish sites offered a way to opt out of 2FA if your password has enough entropy (128 bit random string). These are not getting cracked anytime soon. I store my TOTPs in keepassxc with the other passwords anyway. The keepassxc database is the "something you have" and its password is "something you know", and the random string is a testament to that. Also stop forcing SMS 2FA please. I don't want to need to have a phone.

anfilt 2y ago
I agree although sites still might concerned about password re-use they could just have an option to generate what is basically a key. Instead of a password and some sort 2fa "token" which is basicallly a key. Accept for that 2fa token only a low amount the entropy is capable of generating is used. I also agree sms 2fa is just broken/garbage.

evolve2k 2y ago

> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can break into my ssh account or gmail account protected by such a password. Oh dear. The issue isn’t the brute force, it’s that the online services leak and get cracked. And in an instant a single script takes the newly discovered username password combo and starts hammering it into the top 10000 websites, all within moments of the leak data becoming available. Your super secret favourite phrase is worth crap once leaked alongside your email address. Further don’t choose Microsoft for your Auth app, Go with an open source option, maybe one that encrypts and syncs so you have multiple devices just in case.

ajd555 2y ago
I could not agree more with this comment. OP entirely misses the point of 2FA. I sleep so much better at night knowing that I have different passwords for every account, and 2FA where possible. One should not write about 2FA when one uses the same "uncrackable" password everywhere...
- autoexec 2y ago
  Maybe I missed it (it's early and I haven't even had coffee yet) but where did the author say they resued the same password over multiple sites?
femtozer 2y ago
Not sure I understand — passwords are generally hashed in databases. Even if leaked, an attacker would still need to brute-force the hash to retrieve the actual password, wouldn’t they?
- evolve2k 2y ago
  You’d think so. But over and over plain text leaks of passwords is the practical reality of the modern internet. A disgruntled staff member, poor tech practices or someone working out a way to get in and get access. The https://haveibeenpwned.com/ https://haveibeenpwned.com/ project regularly shares new breached datasets. Reusing passwords across websites without MFA is just not not not recommended in 2025.

megous 2y ago

> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can break into my ssh account or gmail account protected by such a password. SSH... no, they can't. Gmail... yes, you're basically giving your password in plaintext to someone on the internet. I dislike 2FA for similar reasons, but I would rigorously segregate remembered passwords between those shared with some service, and those used locally.

gibibit 2y ago

I agree with the article. Maybe businesses are trying to protect themselves, but as a user, mandatory 2FA reduces the level of security I can achieve for myself. Because security is not just confidentiality, it's also availability: the "Security CIA Triad" is Confidentiality, Integrity, and Availability. If I can lose access (availability) to my online account by losing some physical item (e.g. lost cell phone), or if some third party can prevent me from accessing my 2FA (e.g. banned from my email provider by DMCA takedown request), then I have my availability, and hence overall security is at risk. Additionally, requiring a phone number for online services means that the confidentiality of my identity is reduced. It becomes impossible to be anonymous. For instance, you can't use Signal messenger without a phone number, so there's a chance your identity can be leaked.

gpi 2y ago

Can't seem to access the site over https.

jackman3005 2y ago

1password for unique long passwords per account. I store OTP in 1password as well for the extreme convenience it offers on desktop & mobile. Backup TOTP are put in .txt files for each service and in a folder encrypted by Cryptomator (using a unique pw not used by any other services, esp. 1password). This encrypted folder is put on flash drive on my keychain and synced into my google drive folder. This feels to me like a pretty good balance between convenience and security. Not 100% of my eggs are in one basket, but it's true that my 1password account password needs to be long and well-guarded and never re-used for anything else. Also putting a lot of trust into 1password to not get breached...

prima-facie 2y ago
> Backup TOTP are put in .txt files for each service and in a folder encrypted by Cryptomator I do something similar but instead use KeePassXC to securely store copies of totp secrets.

eternityforest 2y ago

I know lots of people who have been hacked with passwords... If you reuse it, it gets leaked, if you don't reuse it, it's very hard to remember all your 74653 different accounts. And some of us don't have reliable muscle memory... Having our SSH password suddenly vanish would be undesirable.

wisdomalfred 2y ago

[dead]