News for hackers. Stuff that matters.

A comment on What I Wish I Knew About U2F and Other Hardware MFA Protocols. Parent comment

Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by userbinator on Friday April 16, 2021 @11:53PM (#26841455)
not just optional codes but "you must write these codes down, we'll check later to make sure you did" or something like that.

...which people will still not do, or misplace/erase due to disuse, etc.

Security and availability are always at odds with each other. The question that you should always have when choosing a level of security is "does the risk of denying everyone access --- including myself --- outweigh the risk of someone other than myself gaining access?"

[ Parent | on HN ]
Re:What I Wish I Knew About U2F and Other Hardware MFA Proto... by tomatocracy on Saturday April 17, 2021 @07:42AM (#26843507)
Isn't minimising the "I lost them/forgot where I put them" scenario the point of checking you still have them (not just asking - checking eg by saying "enter one of the codes")? That way, if you don't have them, you can print a new set of backup codes while you still have your "normal" second factor to hand.
[ Parent | on HN ]