Re:Ask HN: If I get locked out of everything, please try to ...
by Tainnor on Tuesday December 13, 2022 @05:32AM
(#33966937)
If one of the factors is widely known, it's effectively not two-factor anymore.
[ Parent
| on HN ]
Re:Ask HN: If I get locked out of everything, please try to ...
by modeless on Tuesday December 13, 2022 @11:10AM
(#33970767)
No security system is absolute, and treating all threats as equally possible leads to terrible security decisions like not using printed recovery codes for fear of them getting stolen. You must pick a threat model before you can evaluate the security of a system.
Treating printed paper codes as "widely known" and effectively useless simply because they could theoretically be stolen is silly. In a reasonable threat model for almost all people, the intersection of the set of threats that might get access to printed paper codes and the set of threats that might hack/phish your password is very small. The vast majority of threats are still protected against, while the very real possibility of being locked out of your account is drastically reduced. It's a good trade for almost everyone.
Re:Ask HN: If I get locked out of everything, please try to ...
by Tainnor on Thursday December 15, 2022 @11:05AM
(#34001576)
I don't disagree with this, I disagree with the way you formulated it initially. There's a difference between sharing recovery codes with 2-3 trusted people vs. posting them literally everywhere which your original post seemed to imply.
Re:Ask HN: If I get locked out of everything, please try to ...
by THENATHE on Tuesday December 13, 2022 @02:39PM
(#33974564)
Yea but the chances of some dude in Bangladesh finding out your 2fa code because you lost your wallet approaches 0%. Joe Blow from Kentucky ain’t gonna be the one stealing your account.