As long as that factor is auth app based, and not email/text/call/proprietary app I’m all in. If I need to go digging for the second factor for 5 minutes, I’m almost always going to turn it off. Texts emails and calls all get delayed regularly, and it’s super fun to have to sit with my thumb up my ass waiting 10 minutes for an OTP that was good for 5.
Comment on Researcher uncovers one of the biggest password dumps in recent history
1984@lemmy.today 11 months ago
People really should use multi factor auth on important sites they rely on…
KairuByte@lemmy.dbzer0.com 11 months ago
1984@lemmy.today 11 months ago
I think for email it’s essential, it’s critical that someone doesn’t make it into your email. Otherwise they can reset all your other passwords.
I have mfa on my account but I just click a checkbox after first time to not ask again. I’m still protected by it and don’t have to do anything until I clear my cookies (which I don’t for email).
Scolding7300@lemmy.world 11 months ago
I think he’s thinking of TOTP noy being the standard, where you’d just pull out your totp app and paste it without waiting
KairuByte@lemmy.dbzer0.com 11 months ago
Precisely, my brain just completely forgot the term for it and after minutes of not being able to remember for the list of my I just loosely described it. TOTP is exactly what I meant.
stealth_cookies@lemmy.ca 11 months ago
Ideally they also support a hardware key. Not nearly enough websites out there support FIDO/Webauthn.
HubertManne@kbin.social 11 months ago
I wish more were like azure where you can get a phone call and hit pound
KairuByte@lemmy.dbzer0.com 11 months ago
That’s also a less secure version of 2fa. Granted, it is still better than nothing, but sim spoofing is still a thing that happens regularly. Making it much less useful in a targeted attack.
HubertManne@kbin.social 11 months ago
over texting or an app. because an app requires a smartphone.
Akuchimoya@startrek.website 11 months ago
One time I had to use a website where the email 2FA expired in 30 seconds! I usually keep my email client open while my computer is on, but, come on, that was ridiculous.
MDKAOD@lemmy.ml 11 months ago
Ya know, I have no issues with 2fa, but I watch older folks struggle with it for some reason. They can’t fathom the ‘magic’. But I don’t understand 2fa on utility websites that are only payment portals that obfuscate account numbers. Like “enable 2fa for account security!” why? Because someone who has found my credentials on the dark web might pay my bill?
TORFdot0@lemmy.world 11 months ago
They can use the information to try to send you fake invoices to try to scam you, or use your personal information to social engineer you or your relatives, attempt identity theft etc. Basic info-sec is still important. It’s like leaving the bathroom door open when you poop. It probably isn’t going to hurt you if you leave it open but its still probably a good idea to shut the door if its a public restroom
MDKAOD@lemmy.ml 11 months ago
Alright, that makes some sense. Fair enough.
Lesrid@lemm.ee 11 months ago
I’m also trying to find the angle on it. Like with my ISP I guess someone could have my password but not necessarily my address? So from the ISP site they could peek at my address??? I’m not even sure it has my address unobfuscated but I figure it must somewhere, like “view this bill”.
brianorca@lemmy.world 11 months ago
A lot of ISPs provide email, too. So getting an ISP password lets them reset your other passwords which used that email address for the “forgot email” prompt. (I’m guessing you don’t use your ISP provided email, but you’re not “most people”.)