71–80 of 228 posts
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
As far as cloud storage goes, standard notes might be a good option, I don't use it for 2FA, but it's an extension they provide.
For comparison, here's GH Policy: https://docs.github.com/en/github/authenticating-to-github/r... > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. I think it's hard to securely restore an account that is using MFA without being vuln…
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
Isn't there Authy?
As someone who had two phones break and loose my 2FA for github, this makes me sad They were willing to help me - took a week but I got my account back
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
Earlier quoted context omitted.
Does no one else take real vacations these days?
Even on vacations people do connect atleast once a day. Even if to just check on possible family emergencies.
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
Isn't there Authy?
For comparison, here's GH Policy: https://docs.github.com/en/github/authenticating-to-github/r... > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. I think it's hard to securely restore an account that is using MFA without being vuln…
What about using time ? Let support reset MFA, but with a mandatory x days (3? 5? 7?) “cooling period”. And spam the user email with notifications during that time period.
For individual accounts that's different though. Even with a three day waiting period it's not guaranteed that a user will see it. It also is a big cost on Gitlab which isn't justified for free users.
Earlier quoted context omitted.
Does no one else take real vacations these days?
Even on vacations people do connect atleast once a day. Even if to just check on possible family emergencies.
In fact, I know people who choose the camping grounds for that. There's no better way to properly relax than not having any possibility to check what's going on in the world.