3 ms·

Use to be now they are requiring 2fa for addon domains over a certain amount

• ceejayoz 5mo ago
  Of all the things to be upset about, mandatory 2FA doesn't seem like one.
  • ipaddr 5mo ago
    2FA has been in place for years through email but this new requirement forces a phone.
    • ceejayoz 5mo ago
      Good. E-mail based 2FA is bad, and they appear to support TOTP too as an option, as they should. Wish they supported U2F though.
      • ipaddr 5mo ago
        Why is email based 2fa bad but phone good? There are classes of issues you get through phone 2fa compared to email
        • ceejayoz 5mo ago
          Typically, you can also reset password via email, so it's really only one factor. Compromised email = compromised server.
• maccard 5mo ago
  It’s negligent to not use 2FA for any cloud platform where credentials can be used to spin up resources.
  • ipaddr 5mo ago
    I should have been more clear 2FA has been in place for years the phone requirement is new.
    • jlokier 5mo ago
      They use TOTP for 2FA (industry standard), which doesn't require a phone. Their help page lists a bunch of 2FA app options, all of which run on phones, so it's understandable to think a phone is required. (I'm disappointed they don't list the app I use, which is Aegis Authenticator.) But actually you can use any TOTP app, and they don't all need a phone. For example, macOS (desktop) has built-in TOTP 2FA as part of the password manager.
• esseph 5mo ago
  Good! Should have been done long ago