3 ms·

> Lately some services started requiring 2FA. One of them is Github. Once I added 2FA to my Github account, it became less secure for me. Because security is no

> Lately some services started requiring 2FA. One of them is Github. Once I added 2FA to my Github account, it became less secure for me. Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. > > Now, my Github access depends on the second factor, which I have chosen to be Microsoft Authenticator running on my phone. I genuinely do not know what will happen if my phone breaks down, so I downloaded TOTP codes from Github and even tried one to see if it works, and so far it does, but now I have one less TOTP code to use in case something happens. Moreover, since Github is now a special case for my password management routine, I am afraid I may loose those TOTP codes and be totally locked out of my account What? That's not what security means. Sure, you traded convenience for security. Why is this upvoted at all?

TeMPOraL 2y ago
Because the current obsession with security is making systems unsafe and unreliable for users, all while trying to get those users more dependent on said systems in their daily lives. What is the biggest risk factor with Google account for me? Is it an attacker guessing my password, impersonating me, stealing my photos? No. It's me breaking my phone, and no longer being able to pass 2FA[0][1]. The second biggest risk? Me typing a wrong comment or YouTube, or doing any other minor transgression against ToS of some Google service, and losing access to everything in one go, with no recourse[2]. Note that literally nothing in meatspace ever requires as careful management over years to decades, as 2FA does. There is always a recovery procedure. You may need to stop by the court or a notary, but no matter the fuckup, you can always recover access - to everything except modern Internet services. -- [0] - Yes, I have the security codes I generated 15+ years ago; I have them on paper, somewhere. Like most people, I suck at keeping small paper documents accessible and available over years. [1] - Also yes, I did break my phone, and I survived this without data loss only because I had a complex setup around Pebble and Tasker, that allowed me to operate the phone with non-functioning screen remotely to the point I could mirror the display to the computer and continue from then. Most people in most situations can't do that. [2] - Other than complaining on HN and hoping some Googler will advocate internally for me - which, as far as I know, they're explicitly not allowed to do, and it's a career-risking move.
ozim 2y ago
Well OP is kind of correct because in security importance is given to CIA Triad: Confidentiality, Integrity, Availability. Availability is important part of any system, if you lock out people, system will be secure but it stops serving its purpose. Where OP fails is he seems not to understand password leaks and how much password+e-mail+phone number+other info lists are out there. There is credential stuffing and password spraying running around from leaked passwords, so you can try dozen users on FB and just hit jackpot with one or couple, you don't have to brute force each one of them as there are countermeasures for that. Even if you have weak password with a trick it is trivial to find out your trick when your password leaked from 5-10 services where you used the same e-mail.
_dain_ 2y ago
>What? That's not what security means. Sure, you traded convenience for security. Your Google/Microsoft/FB/etc accounts are used to sign in or access information about other extremely important things in your life, like your bank, payroll, travel companies, health records, taxes, insurance, everything really. If you get locked out of those SSO "identity providers", you get transitively locked out of everything else. Which means you could end up without access to money, unable to pay rent, unable to travel, contact friends for help, etc. In other words, your physical security would be threatened, as in you might literally become homeless and die of exposure.
megous 2y ago
Handling recovery codes is part of security. There are many gotchas even with a typical recommendation to print them and store them physically.

TeMPOraL 2y ago

Because the current obsession with security is making systems unsafe and unreliable for users, all while trying to get those users more dependent on said systems in their daily lives. What is the biggest risk factor with Google account for me? Is it an attacker guessing my password, impersonating me, stealing my photos? No. It's me breaking my phone, and no longer being able to pass 2FA[0][1]. The second biggest risk? Me typing a wrong comment or YouTube, or doing any other minor transgression against ToS of some Google service, and losing access to everything in one go, with no recourse[2]. Note that literally nothing in meatspace ever requires as careful management over years to decades, as 2FA does. There is always a recovery procedure. You may need to stop by the court or a notary, but no matter the fuckup, you can always recover access - to everything except modern Internet services. -- [0] - Yes, I have the security codes I generated 15+ years ago; I have them on paper, somewhere. Like most people, I suck at keeping small paper documents accessible and available over years. [1] - Also yes, I did break my phone, and I survived this without data loss only because I had a complex setup around Pebble and Tasker, that allowed me to operate the phone with non-functioning screen remotely to the point I could mirror the display to the computer and continue from then. Most people in most situations can't do that. [2] - Other than complaining on HN and hoping some Googler will advocate internally for me - which, as far as I know, they're explicitly not allowed to do, and it's a career-risking move.

ozim 2y ago

Well OP is kind of correct because in security importance is given to CIA Triad: Confidentiality, Integrity, Availability. Availability is important part of any system, if you lock out people, system will be secure but it stops serving its purpose. Where OP fails is he seems not to understand password leaks and how much password+e-mail+phone number+other info lists are out there. There is credential stuffing and password spraying running around from leaked passwords, so you can try dozen users on FB and just hit jackpot with one or couple, you don't have to brute force each one of them as there are countermeasures for that. Even if you have weak password with a trick it is trivial to find out your trick when your password leaked from 5-10 services where you used the same e-mail.

_dain_ 2y ago

>What? That's not what security means. Sure, you traded convenience for security. Your Google/Microsoft/FB/etc accounts are used to sign in or access information about other extremely important things in your life, like your bank, payroll, travel companies, health records, taxes, insurance, everything really. If you get locked out of those SSO "identity providers", you get transitively locked out of everything else. Which means you could end up without access to money, unable to pay rent, unable to travel, contact friends for help, etc. In other words, your physical security would be threatened, as in you might literally become homeless and die of exposure.

megous 2y ago

Handling recovery codes is part of security. There are many gotchas even with a typical recommendation to print them and store them physically.