News for hackers. Stuff that matters.

A comment on Turn on MFA Before Crooks Do It for You. Parent comment

Re:Turn on MFA Before Crooks Do It for You by therein on Saturday June 20, 2020 @04:30AM (#23582624)
Authy on desktop sounds like such a terrible idea, though. Take that second factor and put it right next to the first.
[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by the_pwner224 on Saturday June 20, 2020 @06:35AM (#23583111)
How is this any different from what you have on your phone?

If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email.

The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.

[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by yumraj on Saturday June 20, 2020 @04:59AM (#23582738)
Not sure I get it. 2FA does not protect anyone from someone having your password AND having your phone or desktop.

It prevents from someone, somewhere, having your password but not your 2nd factor.

[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by tonyedgecombe on Saturday June 20, 2020 @06:17AM (#23583033)
If someone manages to put software on your desktop then they have access to your password and 2nd factor.
[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by the_snooze on Saturday June 20, 2020 @08:56AM (#23583679)
I mean, it's game over in pretty much any situation that your endpoints are compromised.

It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."

[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by tonyedgecombe on Sunday June 21, 2020 @04:35AM (#23590703)
I'd still rather they didn't have direct access to my second factor in that situation.
[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by Spivak on Saturday June 20, 2020 @08:26AM (#23583563)
But that’s your phone too. The second factor, is practice, having access to an active session on your device.
[ Parent | on HN ]