Re:FTC takes action against CafePress for data breach cover up
by 4oh9do on Monday June 27, 2022 @05:25PM
(#31901015)
> Again, 2FA isn't an account recovery process at all; it's a reason you need account recovery.
Your reading of the FTC text seems to be that you think the FTC has conflated account recovery with 2FA, but I don't think that's the case. Instead, my read is that they're suggesting that password breaches can be rendered moot points by requiring 2FA for accounts, so that the compromise of a password would not require an account reset in the first place.
Re:FTC takes action against CafePress for data breach cover up
by tptacek on Monday June 27, 2022 @06:23PM
(#31901661)
I'm reading the plain language of the agreement, which requires the replacement of security questions and answers, and is not in fact a manifesto about the insecurity of passwords writ large.
But technical language aside: a requirement that CafePress fully adopt 2FA also doesn't make sense, because its users will not fully adopt 2FA. The users that can't 2FA are the interesting case here, and the thing I'm calling out.
Again, 2FA isn't an account recovery process at all; it's a reason you need account recovery.
To get a general sense of where we're at as an industry with this, look at the process for what happens when you lose an AWS 2FA secret:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...