4 ms·
"And please remember 2FA is not a substitute for a good password policy." 2FA is not a replacement no. What it does is increasing security in environments wher
by eitland 13y ago
"And please remember 2FA is not a substitute for a good password policy."
2FA is not a replacement no. What it does is increasing security in environments where you might risk that your main password is compromised.
This doesn't mean you are free to reuse passwords but it still significantly raises the bar for a successful attack.
- taf2 13y agoI can't help but think maybe this is similar to having only the login screen https, but the rest of the site http with the auth cookie being passed around in clear text... Initially, we thought we were being more secure because we secured the transfer of the password to the website, but in reality the auth cookie is just as important. In the case of typical 2 factor authentication via phone - if I can reset your password via a code being sent to your phone, then you've lowered the security of your password from maybe an 8 digit password to a 4 digit numeric pin... Of course, I would need to know your phone number, which may be difficult to guess?
- uxp 13y agoBasic 2 factor authentication doesn't even cover the scope of password resets, so the idea that 2FA is flawed when used in conjunction with cellular networks is a terribly unthought out argument. If any service uses a token reset code sent to a phone as SMS or voice message, then that service is using a flawed password reset mechanism using the idea that cellular networks are highly insecure, regardless if it's also using 2FA. _Any_ single authentication mechanism over cellular networks is flawed using the same logic. 2FA, arguably, is more secure over cellular networks because it requires an authentication mechanism (the password) that is not transmitted over SMS/voice cellular in a plain format (assuming the authentication itself is sent over TLS/SSL).
- taf2 13y agogreat points, clearly i was misunderstanding, the reset mechanics i was describing are clearly a very bad idea and not 2 factor. thanks!