14 ms·
It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, an
by grrowl 13y ago
It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry.
Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.
- sgeisenh 13y agoAuthenticator tokens are pretty robust systems. I'd like to see more services start to make use of them.
- blueskin_ 13y agoDefinitely, as long as there was a common standard (and open source, of course). Have a keychain token that you can link to accounts, then enter a password on that and it gives you a (time limited) key to use to login.