Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix?
Digital OTP, like the kind provided by 1Password or Bitwarden, are a little more convenient. And having Google Voice means I can easily copy codes sent via text straight from my laptop.
But it's something I'd rather not even have to pay attention to. I don't need to manually enter a code to get HTTPS.
Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration.
(As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)
1. username and password for website
2. token sent to email
3. login for email (auto logged out)
4. email 2fa that requires SMS 2FA or Google auth, stored on phone
5. pincode / face for phone
Oh! I could add 2 real more:
-1: password manager login
0: password manager 2faNah. I currently work for NYU and find their 2FA system pointlessly burdensome. I need to type my password (in practice, unlock my password manager) and then procure my second factor every day, on every device I use. Inevitably any mobile app I need to interact with requires doing all of this again, except this time inside a custom webview that doesn't remember cookies. I have never worked for a tech company that made things this annoying, and I can't fathom how bad it must be for anyone who needs to use e.g. a screen reader.
At first, there was 2FA where you could either
1. Download the proprietary app OR
2. Get texted the code.
(i.e. no "do-it-yourself" e.g. Google Authenticator option.)
This means you must have a cell phone of nearly any kind. Mostly reasonable.
Turns out; option 2 cost somebody like half a cent every time it was used and also was far more popular than anticipated.
So they just got rid of 2. That's all, no mitigation.
And now you've DRASTICALLY increased the tech requirements for a major public school; I know of IT instructors in the place who did not actually regularly use a phone "fancy" or new enough to handle the official app.
Utter BS.
The founders and investors of 1Password, perhaps.
It's a funny frame device to float a couple different satirical ideas. I'm sure faculty members – and most people – understand that 2FA is a necessary minor annoyance.
Requiring signing into my Microsoft account (with two step authentication code) every twenty four hours on a company laptop you control is obnoxious. You should educate and empower your employees, not treat them as the weak link in your armor.
The yearly security training is probably just a compliance checkbox companies do. If they wanted an educated workforce that practices security first there are other far more effective approaches.
Of course, that all ignores the fact that employees are weak links not because they are dumb, but because they don't have an incentive to protect the company when they or their families are put in danger by a threat actor.
Not to mention the pain when said factor is lost. I just replaced a broken phone, and having to login in everywhere that previously required an Authenticator has not been fun.
https://www.mcsweeneys.net/articles/oh-my-fucking-god-get-th...
https://www.mcsweeneys.net/articles/its-decorative-gourd-sea...
https://www.mcsweeneys.net/articles/brandon-our-new-lets-go-...
McSweeneys’ satire and parodies are rarely in good jest in my experience. This is a criticism of the move towards 2FA/MFA make no doubt about it. The writer, and the editors who let this through, are not happy about this state of affairs.
McSweeney’s isn’t a no-name blog or journal either — its name holds sway over those who work in literary arts.