4 ms·
Password re-use is the bigger issue. No one can crack your super-strong multilingual password. But if a service accidentally leaks it, then it doesn't matter.
by edent 2y ago
Password re-use is the bigger issue.
No one can crack your super-strong multilingual password. But if a service accidentally leaks it, then it doesn't matter.
Credential Stuffing is how 23andMe were hacked. People reused password, they were leaked from another service, attackers tried them on a variety of sites until they hit the jackpot.
Unique passwords prevent that attack. Can't remember a thousand different passwords? Use a manager.
Don't want to use a manager? Switch on 2FA. Weak passwords and password reuse ceases to be a problem.
Yes, as the article points out, it slightly reduces ease of login. But that seems like a sensible trade off.
- benoliver999 2y agoI would advise against password re-use regardless of 2FA. - Lots of flaky 2FA implementations out there where it's easy to get in without it, if you have the password - If a service doesn't offer 2FA you are now unable to use it for fear of sharing your password (like this website) I suppose logically if your email is 2FA, then someone can't do 'forgot password', but man that feels super flaky.
- freeone3000 2y agoGmail “magic link” login (which is the reset password flow, but without needing the password) is the same security profile as Google OAuth, while exposing less user data (name and profile are nonoptional) — and also equivalent to an Android-managed passkey.
- 9dev 2y agoWith the price being an absolutely awful user experience. Did the email arrive yet? Or wasn’t it sent in the first place? Oh wait, let’s check spam. Send again, what do you mean try again in five minutes, I want to sign in now!
- benoliver999 2y agoIt's good UX for websites with extremely long periods between logins. Like a service you access once a year, or even every two years. Or a service where you might never have to log in ever (I run such a thing at work). I would not want this for my google account or the like.
- Krutonium 2y agoIf you pop a Google account, Reddit no longer has 2FA, just as an example. Plenty of examples of stupidity like that around. (Logging into Reddit with a Google account bypasses any and all forms of 2FA auth.)
- autoexec 2y ago> Yes, as the article points out, it slightly reduces ease of login. But that seems like a sensible trade off. In addition to making the login process more complicated 2FA can also introduce privacy concerns. A third party authenticator app can collect all kinds of data for it's own reasons (For example MS's app will request location and camera permissions) and that 3rd party could also track which services you log into, when you access them, and how often you access them. 2FA can also cause you to be locked out of our accounts, either temporarily or forever.
- vel0city 2y agoHaving a TOTP app request camera permission isn't nefarious. In fact, I'd 100% expect it. Most of the time people import a TOTP secret from a QR code. Microsoft Authenticator can be configured by an admin to provide geo-blocking for attempts, so once again not just some arbitrary demand. It's a selling point of the product.
- autoexec 2y agoIt's not unreasonable for Microsoft Authenticator to request those permissions, but just because they can justify asking for them it doesn't nessesarily mean that you want Microsoft collecting that data, or any data, about what you're doing and when. One of the nice things about hardware tokens is that they keep third parties out of your business entirely.
- tracker1 2y agoYeah, especially in that MS Authenticator is usually configured for Push mode as opposed to TOTP. That said, I prefer simple/general TOTP implementations that I can just use with my password manager for my own convenience. But the permissions being asked for are completely reasonable for the actual use of these applications.
- saghm 2y agoFor a few years now, there's also been the option on Android to avoid giving permanent permissions to most apps that request use of one; when an app requests a permission for the first time, I'm prompted to choose from the options "allow only this time", "allow only while using the app", or "allow always" (in addition to having the option to completely deny the permission of course, although in many cases an app might refuse to function if that's chosen). Scanning TOTP QR code seems like a really great use-case for the "allow only this time" option; presumably adding a new TOTP secret is a pretty infrequent reason for opening the app compared to getting a code from an existing one, so having to manually accept the request each time doesn't seem like it would be that much work. I'm not familiar with with iOS to know if something similar to this exists for it, but I'd honestly be more surprised if there _isn't_.