News for hackers. Stuff that matters.

A comment on The difficulty of switching authentication providers. Parent comment

Re:The difficulty of switching authentication providers by arubania2 on Tuesday June 28, 2022 @12:33PM (#31909872)
That is also true for every password-based account without 2FA by means of password reset.

Plus, having someone access your email account means you're pwned anyway - they can see your sensitive documents that were received / sent as attachments, they can read recent conversations and phish information, maybe even ask for a downpayment, etc.

So the basic rule should be: don't lose access to your email.

That doesn't mean that email-based login is good, just that IMO this point is kind of moot.

Also, do email-based login flows allow 2FA?

[ Parent | on HN ]
Re:The difficulty of switching authentication providers by shafyy on Wednesday June 29, 2022 @06:17AM (#31918291)
Yes, you're very pwned if somebody has access to your email account. But less pwned than if they can also access all your other accounts directly at the same time =)

Of course, combining email-based login with another factor makes it more secure again, I was just talking about one factor.

[ Parent | on HN ]
Re:The difficulty of switching authentication providers by prash_murali21 on Wednesday June 29, 2022 @02:07AM (#31916993)
Agree with this. I don't see why you cannot add 2FA to email based login flows.
[ Parent | on HN ]