3 ms·

> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. Th

by latexr 2y ago

> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances. This felt like the author bending over backwards to justify their choice. They find 2FA less convenient and conflate it with being less secure. It’s not the same thing. It’s OK to say “not all my accounts are equally important and I need to access some of them in situations where 2FA and complex passwords aren’t worth it”. It’s not OK to sell the idea that 2FA does not generally offer security. This reminded me of the “SEO expert” a few years back which was trying to convince everyone, with wrong information, to not use HTTPS (which, I realise only after writing this, the author’s website also doesn’t use).

guappa 2y ago
If we define data that can't be accessed by anyone as secure, throwing disks in a furnace is how you achieve security. I don't think this definition is very helpful though. So I prefer the one where the entities that need to have access still can access.
- latexr 2y ago
  > I don't think this definition is very helpful though. Because it’s a straw man, and straw men aren’t helpful for discussion. No one is suggesting making data wholly inaccessible. Data that you cannot access “at any time and in any circumstances” (author’s words) can still be secure. A fairer analogy would have been storing disks in a locked safe in your home. It’s not as convenient to access it, but it is secure. Should you do that for all your data? No, but neither have I advocated for that. I very clearly stated that I think it’s OK to have different levels of protection for different types of data.
mouse_ 2y ago
If I can't access money that I secured, I didn't secure it properly.
- latexr 2y ago
  Which has nothing to do with my argument. See the reply to the other user, which expands. https://news.ycombinator.com/item?id=43421721 https://news.ycombinator.com/item?id=43421721
Spooky23 2y ago
Security is about risk management. If the value of what you’re protecting is low, or the consequences of not accessing something is high, than the MFA control may not add value. The problem is in general people are really bad at assessing risk. You tend to see extremes.

by latexr 2y ago

guappa 2y ago

If we define data that can't be accessed by anyone as secure, throwing disks in a furnace is how you achieve security. I don't think this definition is very helpful though. So I prefer the one where the entities that need to have access still can access.

latexr 2y ago
> I don't think this definition is very helpful though. Because it’s a straw man, and straw men aren’t helpful for discussion. No one is suggesting making data wholly inaccessible. Data that you cannot access “at any time and in any circumstances” (author’s words) can still be secure. A fairer analogy would have been storing disks in a locked safe in your home. It’s not as convenient to access it, but it is secure. Should you do that for all your data? No, but neither have I advocated for that. I very clearly stated that I think it’s OK to have different levels of protection for different types of data.

mouse_ 2y ago

If I can't access money that I secured, I didn't secure it properly.

latexr 2y ago
Which has nothing to do with my argument. See the reply to the other user, which expands. https://news.ycombinator.com/item?id=43421721 https://news.ycombinator.com/item?id=43421721

Spooky23 2y ago

Security is about risk management. If the value of what you’re protecting is low, or the consequences of not accessing something is high, than the MFA control may not add value. The problem is in general people are really bad at assessing risk. You tend to see extremes.