Re:Google is going to turn on 2FA by default
by ironmagma on Sunday May 09, 2021 @03:44AM
(#27094065)
2FA is great when you want it on an account. If it’s being forced on you however, it’s insanely irritating, often for no reason. The user should have the power to decide if that information is worth the extra protection.
To your point, what is an anti pattern is requiring certain special characters or a certain mixture of character sets while ignoring other valid safety approaches such as password length IMO. Regardless, if a user is constantly resetting their password due to forgotten password, that amounts to 2FA because of the emailed reset tokens anyway. Modern users have adequate access to password managers that it should be simple to put them back in control.
Re:Google is going to turn on 2FA by default
by CodesInChaos on Sunday May 09, 2021 @10:59AM
(#27096444)
Rules like "At least one special character" are silly. But I like estimator (e.g. zxcvbn) based strength requirements. Plus checks against blacklist like hibp.
Even with the most secure password, it is still useful to have an additional gate to get past before being able to perform any actions on your account, You are in control; you could deny the 2FA for an attacker just by doing nothing, whereas kicking an attacker out after they've logged in with your password is a lot more difficult and requires active action on your part. I remember being paranoid checking the list of recent sessions (and clicking the "end all other sessions" button multiple times a day) in the old Gmail design, and also giving up as keeping an eye on that list 24/7 was futile and a waste of time. With 2FA, I don't have to.