1–10 of 253 posts
Having not had any feedback on it in a while and the idea not taking off, today somebody messaged me to say that had implemented it in their product.
1. Obviously I think this is great and more secure
2. Tell people about things you do that they played a part it- it might just make their day.
If you don't mind I'm just just pasting the URL into a comment to make it a link:
https://syslog.ravelin.com/2fa-is-missing-a-key-feature-c781...
That’s awesome. I was expecting a lament on how an amazing startup idea was stolen and monetized by someone else. Glad I’m wrong and the world is a little bit better.
One of my GitHub projects was used in a demo at Google Cloud next a while ago. the presenter was considerate enough to attribute the project to me by name during the demo and even sent me an issue just letting me know about it. That was so nice! Absolutely people should do this.
Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed.
So, with a proper login panel, my 2FA being asked does not mean that someone has my password.
Edit: this is, for example, the recommendation from PCI to separate "Multi-Step Authentication" from true "Multi-Factor Authentication": https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authe...
I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…
Customer support burden when the lose the 2FA key is solved by adding a hefty fee (around €100) to recover it. No webauthn support yet though.
I would consider that as a bug, not as a feature. If the login panel behaves differently on a correct password than on a wrong password, that's an information leak that must be fixed. Authentication must be evaluated and rejected only when all factors are already provided, and the rejection error should not disclose which of the factors failed. So, with a proper login panel, my 2FA being asked does not mean that some…