3 ms·
Persona ameliorates the need for two-factor auth because you have to have control over an email account registered as the provider for Persona to interact with
by nickbauman 12y ago
Persona ameliorates the need for two-factor auth because you have to have control over an email account registered as the provider for Persona to interact with the user.
Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way.
- ta76767 12y ago> Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way. Can you explain this a little more? I don't think I understand, because to me it sounds like you're saying, "once your account is hacked, two factor authentication won't help because your account has been hacked, so the adversary can disable two factor authentication". Don't major changes to accounts like that sometimes require re-authenticating with all required factors? I need to do this if I want to add a bill pay recipient to my bank account even if I'm already logged in.
- nickbauman 12y agoSocial engineering is the most common cause of account hijacking with two-factor. Check this out: they used his cell phone provider to get at his google account. http://www.makeuseof.com/tag/two-factor-authentication-hacked-shouldnt-panic/ http://www.makeuseof.com/tag/two-factor-authentication-hacke...