Re:The New Ten-Factor Authentication Processes
by masswerk on Tuesday November 23, 2021 @10:30PM
(#29326662)
> the security benefits are worth it.
Mind that 2FA replaced TANs, which are literally the most secure thing (one-time pads). 2FA is not about security, but about ease of administration.
(As a side effect, 2FA usually puts all the eggs in a single basket and forces you to carry that basket around with you, everywhere you go. Mind that this basket isn't even the basket itself, but one of many ways to access an account connected to another ID, but still the only one accessible to you.)
Re:The New Ten-Factor Authentication Processes
by csteubs on Tuesday November 23, 2021 @09:27PM
(#29326348)
I remember a DevOps engineer at my last job telling me about a "cheat code" where we could type 'push' into the VPN 2FA prompt to have it pushed as a notification to the enrolled device. I've been typing the same command into every 2FA prompt I encounter since then with no luck. I wish that was a standard convention.
Don't get me wrong, the security benefits are worth it. But having to pull out my phone multiple times a day to enter a code from an authenticator app? Dude, my phone communicates with my laptop throughout the day. Why does this need me in the mix?
Digital OTP, like the kind provided by 1Password or Bitwarden, are a little more convenient. And having Google Voice means I can easily copy codes sent via text straight from my laptop.
But it's something I'd rather not even have to pay attention to. I don't need to manually enter a code to get HTTPS.