Re:What I Wish I Knew About U2F and Other Hardware MFA Proto...
by exporectomy on Friday April 16, 2021 @05:23PM
(#26839232)
For services where no admin can get your access back, like most websites, a 3rd factor should be a compulsory part of 2FA. There's a balance between keeping hackers out and keeping yourself out. The more factors you require, the more optional factors you should also require users to have, not just optional codes but "you must write these codes down, we'll check later to make sure you did" or something like that.
Re:What I Wish I Knew About U2F and Other Hardware MFA Proto...
by userbinator on Friday April 16, 2021 @11:53PM
(#26841455)
not just optional codes but "you must write these codes down, we'll check later to make sure you did" or something like that.
...which people will still not do, or misplace/erase due to disuse, etc.
Security and availability are always at odds with each other. The question that you should always have when choosing a level of security is "does the risk of denying everyone access --- including myself --- outweigh the risk of someone other than myself gaining access?"
Re:What I Wish I Knew About U2F and Other Hardware MFA Proto...
by tomatocracy on Saturday April 17, 2021 @07:42AM
(#26843507)
Isn't minimising the "I lost them/forgot where I put them" scenario the point of checking you still have them (not just asking - checking eg by saying "enter one of the codes")? That way, if you don't have them, you can print a new set of backup codes while you still have your "normal" second factor to hand.
Most services and web sites also give you emergency login codes to print out, though.