News for hackers. Stuff that matters.

A comment on An update on our security incident. Parent comment

Re:An update on our security incident by bawolff on Saturday July 18, 2020 @12:40AM (#23878998)
Almost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset.

2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to

[ Parent | on HN ]
Re:An update on our security incident by fmajid on Saturday July 18, 2020 @06:56AM (#23880501)
But operations like that should require a second randomly chosen individual to verify.

The reality is the public loses credentials and keys all the time and at most companies security takes a back seat to convenience and customer service.

[ Parent | on HN ]