News for hackers. Stuff that matters.

A comment on The low, low cost of (committing) cybercrime. Parent comment

Re:The low, low cost of (committing) cybercrime by rightbyte on Friday September 01, 2023 @05:14AM (#37348471)
> I don't know what the solution should be here

A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Google" is spyware.

I want 2FA for my bank only.

[ Parent | on HN ]
Re:The low, low cost of (committing) cybercrime by larsla on Friday September 01, 2023 @07:12AM (#37349271)
"Login with X" is OAuth, not 2FA. 2FA is a great addition on top of a password per site. Neither a FIDO device nor an Authenticator app provides the site with any extra PI.

Edit: SMS would give them your phone number, but SMS is a really bad 2FA and should not be used

[ Parent | on HN ]
Re:The low, low cost of (committing) cybercrime by indymike on Friday September 01, 2023 @08:28AM (#37349941)
I'm not so sure this is the case. Even less safe 2FA like SMS and email seems to prevent a whole host of cheap attacks. TOTP is much better and can be as anonymous as your login is.

What is sad is that misuse of 2FA data is rampant and causes people to think (rightfully so) as you do.

[ Parent | on HN ]
Re:The low, low cost of (committing) cybercrime by CatWChainsaw on Saturday September 02, 2023 @02:24PM (#37364100)
I don't want MFA everywhere either. I said recently that KYC has gotten out of control. HN doesn't rise to the level of Yubikey. Reddit shouldn't have fingerprints. Musk can kick rocks with collecting PII and employment history.
[ Parent | on HN ]