3 ms·

> Every time a service requires 2FA I rethink if I want to stay with it. I’m sure you feel the same about locks on your car and on your home. I mean, those sil

by rekabis 4mo ago

> Every time a service requires 2FA I rethink if I want to stay with it. I’m sure you feel the same about locks on your car and on your home. I mean, those silly keys, eh? They get so much in the way of going in and out and just using those things. Better if we dispensed with keys entirely, and just left everything unlocked and instantly available.

PaulHoule 4mo ago
Look if I get locked out with real keys and locks I can call the locksmith and get the situation resolved. If I get locked out of Google or Amazon or Facebook I can talk to the hand at best with no recourse at all. A lot of 2FA hardware is garbage, like the Yubikey I had that had the hole attaching it to my keychain worn out in less than two years -- it could have fallen away and been lost.
- rekabis 4mo ago
  If you do 2FA without recovery keys or a recovery eMail, you’re doing it wrong. Everything I have heard from you so far is draped with ignorance and misinformation.
  - PaulHoule 4mo ago
    recovery keys = "write down your password" which they've been telling us to not do for years recovery email/phone = same threat model as regular passwords, and it's a big crack, all the time somebody bribes somebody at a phone carrier to take over the phone number of a crypto whale Practically low-touch services are going to have to resort to these things, but they render 2FA performative. Now at work 2FA is OK because I can go down the street and show my face and ID to the people at CIT and I don't mind it for my bank because their cost structure lets me do the same.
    - rekabis 4mo ago
      Thank you for confirming my second sentence for me. Especially the first sentence of your response - “write down your password”. Wow. This is the worst possible take I can imagine. Like, this isn’t the 1980s anymore, password managers exist - even local-only ones - that can keep both strong passwords and recovery keys totally safe. KeePass in particular can be synced using server-free methods, keeping everything on-device, strongly encrypted, and essentially offline. I suggest you touch some grass and actually educate yourself. TOTP 2FA is a massive leap in security that brings the traditional username+password safely into the modern threat era. Provided that the password is long+strong and the username leverages dot extensions in the eMail (if an eMail) or is a totally unique username (if only a text string), said three-point security can reliably exceed that of passkeys.

by rekabis 4mo ago

PaulHoule 4mo ago

Look if I get locked out with real keys and locks I can call the locksmith and get the situation resolved. If I get locked out of Google or Amazon or Facebook I can talk to the hand at best with no recourse at all. A lot of 2FA hardware is garbage, like the Yubikey I had that had the hole attaching it to my keychain worn out in less than two years -- it could have fallen away and been lost.

rekabis 4mo ago
If you do 2FA without recovery keys or a recovery eMail, you’re doing it wrong. Everything I have heard from you so far is draped with ignorance and misinformation.
- PaulHoule 4mo ago
  recovery keys = "write down your password" which they've been telling us to not do for years recovery email/phone = same threat model as regular passwords, and it's a big crack, all the time somebody bribes somebody at a phone carrier to take over the phone number of a crypto whale Practically low-touch services are going to have to resort to these things, but they render 2FA performative. Now at work 2FA is OK because I can go down the street and show my face and ID to the people at CIT and I don't mind it for my bank because their cost structure lets me do the same.
  - rekabis 4mo ago
    Thank you for confirming my second sentence for me. Especially the first sentence of your response - “write down your password”. Wow. This is the worst possible take I can imagine. Like, this isn’t the 1980s anymore, password managers exist - even local-only ones - that can keep both strong passwords and recovery keys totally safe. KeePass in particular can be synced using server-free methods, keeping everything on-device, strongly encrypted, and essentially offline. I suggest you touch some grass and actually educate yourself. TOTP 2FA is a massive leap in security that brings the traditional username+password safely into the modern threat era. Provided that the password is long+strong and the username leverages dot extensions in the eMail (if an eMail) or is a totally unique username (if only a text string), said three-point security can reliably exceed that of passkeys.