yangwuzrite

This isn't even remotely true. The costs of a security clearance investigation are borne by the sponsoring agency, not the contracting firm. The problem is that it's difficult to justify taking an uncleared person and submitting them for a clearance. You have to have a billet where someone isn't needed to hit the ground running, you have to be willing to take the risk to hire them with the possibility you may have to fire them within 12-18 months if they don't pass the investigation, and the program and/or contracting officer they're assigned to has to be willing to sign off on it (many contracts are written such that pre-cleared individuals are required to staff it).

The author of this article has no idea how 2FA works or why it's used.

2FA is used to prevent or mitigate the impact of phishing or other attacks where a password is compromised (password reuse, random guessing, keylogger, etc.). The author does bring up one hypothetical attack -- a man-in-the-middle attack -- where someone can trick a user into providing their 2FA or triggering an authorization (like with a Duo push). This requires the ability to execute a real-time attack.

FIDO/U2F/Webauthn (I still haven't figured out exactly what you're supposed to call them) security tokens solve that use case by allowing the website to authenticate directly to the token. That can't be phished -- even if you're tricked into a fake website and given a fake webauthn prompt, AFAIK there's no known way to proxy or otherwise intercept that second factor authentication to allow a phishing attack to succeed.

His complaint that the token doesn't have a password is largely pointless -- the token is the second factor, the password on the site is the first. If you're using passwordless FIDO2 logins, then it does have a PIN.

Long story short, this guy is full of crap.

There's no candida or thrush risk from a mask if you don't wear it more than a day at a time.

You wouldn't wear the same set of underwear day after day, don't do it with a mask, either.

So exactly what percentage death rate does it become necessary for you to accept personal inconvenience?

I'm an oldtimer like you.

It's worse than you're even alluding to. I recently purchased a Yubikey with the intention of securing as many accounts as I could with FIDO2 and U2F. Literally the only service I could secure fully with the key was Google.

Google was the ONLY service that supports FIDO2 on both the desktop and mobile (using the Yubikey 5Ci with the lightning connector). Everything else was a hodgepodge mess of two factor options:

Twitter: FIDO2 on desktop only, needs TOTP fallback for mobile. Recovery keys for backup. Facebook: FIDO2 on desktop only, need TOTP fallback for mobile. Recovery keys for backup. LastPass: TOTP or YubiOTP only, email to recover. ProtonMail: TOTP only, recovery keys as backup. US Bank 1: TOTP via their app only, email and SMS as backup. Recovery by customer service US Bank 2: Email only, recovery by customer service. DE Bank: PhotoTAN only, recovery by customer service & postal mail. US Investment Firm 1: Symantec VIP only, email as backup US Investment Firm 2: Email only Reddit: TOTP only, recovery codes as backup. Amazon: TOTP only, SMS as backup Duo: FIDO2 on desktop and mobile, but lack of support for embedded browsers means I need to have HTOP or push as a fallback for some applications on both platforms.

For the services that have recovery keys, I have them in an envelope I keep in my gun safe as well as a PGP-encrypted text file on my computer. I didn't store the TOTP secrets separately, although I probably will next time I re-enroll everything because my Yubikey physically fell apart a month after using it (a common thing with the first batch of 5Cis from what I gather) and I had to move everything back over to TOTP codes.

It's not just the standard for 2FA, it's everything from the bottom up. The 2FA tool, how backups work, how recovery works. It's a complete hodge-podge mess and and, like you mentioned, if it's this big of a pain in the ass for an experienced tech guy, how am I supposed to, in good conscience, recommend this stuff to my non-techie friends?