4 ms·
I love 2FA as well, and always set it up when I can. But if you are going to argue that it is "tremendously inconvenient" to have users fetch a token from email
by stanleydrew 13y ago
I love 2FA as well, and always set it up when I can. But if you are going to argue that it is "tremendously inconvenient" to have users fetch a token from email or some other channel, I don't see how 2FA does any better.
The argument is that if you are not implementing full 2FA, at least implement your single factor as "something you have" rather than "something you know".
Adding a password as an optional second factor instead of vice versa seems preferable to me.