3 ms·
I would advise against password re-use regardless of 2FA. - Lots of flaky 2FA implementations out there where it's easy to get in without it, if you have the p
by benoliver999 2y ago
I would advise against password re-use regardless of 2FA.
- Lots of flaky 2FA implementations out there where it's easy to get in without it, if you have the password
- If a service doesn't offer 2FA you are now unable to use it for fear of sharing your password (like this website)
I suppose logically if your email is 2FA, then someone can't do 'forgot password', but man that feels super flaky.
- freeone3000 2y agoGmail “magic link” login (which is the reset password flow, but without needing the password) is the same security profile as Google OAuth, while exposing less user data (name and profile are nonoptional) — and also equivalent to an Android-managed passkey.
- 9dev 2y agoWith the price being an absolutely awful user experience. Did the email arrive yet? Or wasn’t it sent in the first place? Oh wait, let’s check spam. Send again, what do you mean try again in five minutes, I want to sign in now!
- benoliver999 2y agoIt's good UX for websites with extremely long periods between logins. Like a service you access once a year, or even every two years. Or a service where you might never have to log in ever (I run such a thing at work). I would not want this for my google account or the like.
- Krutonium 2y agoIf you pop a Google account, Reddit no longer has 2FA, just as an example. Plenty of examples of stupidity like that around. (Logging into Reddit with a Google account bypasses any and all forms of 2FA auth.)