One solution with Google at least is that they basically hardly ever require you to reauthenticate on a given device but that obviously doesn't help if the device in question breaks or is lost and is also your soft token.
As you say, not an easy problem. The happy medium depends on the threat model and is somewhere between being able to easily social engineer new access and having to show up in Mountain View with a sheaf of notarized proof of identity documents.
It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios.
When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security.
Of course, the difference is that people understand the value of passports and physical keys, but by and large they fail to grasp the importance of IT security or how to protect themselves. This is, ultimately, an education problem. But we don't have the same internet anymore as 20 years ago, and the problems associated with identity theft, unauthorised access, etc. are much bigger than they were, so we can't afford to be too cavalier about it anymore.
Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager).
Except there may not be any hoops to jump through with MFA if it is "too secure". See "I've locked myself out of my digital life" (a thought experiment):
* https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my...
* https://news.ycombinator.com/item?id=31652650
> Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager).
Except at that point it could be too late and they've lost all access to their digital life/assets.
The difference is I can physically show myself at the embassy or consulate. I can ask a locksmith to come to my place.
I can't do either when I lock myself out of my Gmail account.
Apple is going to start rolling this out in iOS 16 and I expect many sites and platforms to implement support relatively quickly. It’ll take time for this to work its way through the ecosystem and there will still be some trade-offs that will lake someone complain, but this is one of the more promising initiatives in the “passwordless” world that many security professionals have been striving for for quite some time.
I do think that when it comes to software/package maintainers, the heavy lift of having to have an MFA solution is much smaller than for a regular user. Yes, you need to store your one-off keys somewhere safe (I use a password manager and store it in an encrypted file there whether that counts as a second factor or not is debatable, but I think the fact that my 1Password account requires an account key as well as my password when accessed from a new device helps protect against unauthorized access at least), but I do think this is an acceptable trade-off (for now) if you’re maintaining a popular OSS package.
Maintainers have to do a lot of janitorial work, it’s true. And it does often fee unfair. But I don’t think asking people who maintain popular projects to use MFA for their package system is too much.
You are able to give away your password to bad guys, it's really easy because it's exactly like just using the password normally except whoops this was my-bank-login.example and not my-bank.example/login or login.my-bank.example or whatever the URL usually was.
WebAuthn fixes that, everybody should implement and use WebAuthn. To their partial credit RubyGems apparently noticed they ought to do this, and so this message says they're working to implement it.
I tried to do this during the pandemic and the local bank branch didn't have anyone who could give me the right authentication so I had to spend a couple hours going to my local brokerage office to complete a transaction.
> Many services seem to offer one-time codes for storage offline in case this happens.
Adding on: even password managers like 1Password [1] and Bitwarden [2] offer support for TOTP 2FA now.
But a good single factor is probably fine.
If only everyone would use Oauth rather than hiding it behind 'enterprise' plans...
This is the usual security versus convenience problem. The site is forcing you to use an additional factor, but there is flexibility in how that is serviced. Choosing convenience may open paths for attackers, but the impact depends on your threat model.