2FA for added account safety

Discussion in 'Announcements' started by ancestor(v), Nov 28, 2016.

  1. ultimate11

    ultimate11 MDL Novice

    Jun 28, 2015
    24
    2
    0
    Didn't notice about 2FA before I found this thread, I've enabled it with FreeOTP on my iPhone.
     
  2. mbpowner

    mbpowner Guest

    What is 2FA ? What happens if we dont enable it ?

    Pretty sure 2 factor is essential for security these days - Users cant be expected to enable security themselves if thats what your getting at ?
     
  3. TairikuOkami

    TairikuOkami MDL Expert

    Mar 15, 2014
    1,081
    964
    60
    1. Yes. 2FA might improve security, but it can be bypassed.
    2. If you enable 2FA and you loose access to one of the verification methods, you are done. I never ever enable 2FA on my emails.
     
  4. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    12,680
    13,348
    340
    1. Bypass how?
    2. If you should lose a password and you have no alternative to identify yourself you are done the same way....

    It DOES improve it since any attacker on an account has to attack/try with a different IP address while one who has cracked a PW could abuse it from everywhere.

     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. ancestor(v)

    ancestor(v) Admin
    Staff Member

    Jun 26, 2007
    2,830
    5,543
    90
    On the other hand, there simply is no 100% safety. 2FA is optional, not mandatory here, so why bother if you consider it unsafe?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. Daz

    Daz MDL Developer / Admin
    Staff Member

    Jul 31, 2009
    9,550
    67,154
    300
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. ancestor(v)

    ancestor(v) Admin
    Staff Member

    Jun 26, 2007
    2,830
    5,543
    90
    @TairikuOkami
    This has nothing to do with really bypassing 2FA, it's more like picking an alternative route for identification. There is 2FA and "identify by personal questions" ... the latter is described in the article you linked to:

     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. alika12

    alika12 MDL Novice

    Jul 22, 2015
    3
    2
    0
    Awesome, added this to my account.
     
  9. Joe C

    Joe C MDL Guru

    Jan 12, 2012
    3,525
    2,089
    120
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. jadinolf

    jadinolf MDL Member

    Jun 1, 2016
    129
    282
    10
    Gee, this looks good.

    Glad to have the forum back.:)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. mohitkumarsen

    mohitkumarsen MDL Novice

    Sep 5, 2012
    27
    14
    0
    Feeling happy to get forum back again without any trouble. Give some more while to get acquainted with this style. Huge thanks for all associated with the huge job done.
    mohitkumarsen
     
  12. ancestor(v)

    ancestor(v) Admin
    Staff Member

    Jun 26, 2007
    2,830
    5,543
    90
    If you bypass 2FA, then the implementation is a problem, and not 2FA itself. If you've got a super safe door in your home, and burglars break a window to get in, then you wouldn't blame the door... the problem then was the possibility of a bypass, in this case a window, being the weakest point.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  13. alexandergomes

    alexandergomes MDL Novice

    Sep 11, 2017
    7
    1
    0
    authy works well , i am using it .
     
  14. Jasserty

    Jasserty MDL Novice

    Nov 24, 2017
    12
    3
    0
    Really , i want to try , my iPhone 5 can be supported ?
     
  15. dinosaur07

    dinosaur07 MDL Senior Member

    Jan 19, 2016
    259
    366
    10
    I might consider using it.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  16. bebondi

    bebondi MDL Member

    Apr 24, 2017
    123
    46
    10
    This is what i use on my android. It saved my "ass" many times. This should be enabled for security reasons.
     
  17. fabre gastro

    fabre gastro MDL Junior Member

    May 29, 2018
    72
    25
    0
    can we use gpg/ssh keys instead?
    i dont trust 2fa for multiple reasons. but i can trust my gpg/ssh keys. plus it provides strong anonymity
    a simple suggestion.
    if i remember correctly you can perform a server side and client side auth using tls in apache. i haven't run a scan on this site. so i can not speculate much.
    if i can include the certificate then you can be sure its me and none else. these different party/vendor apps makes me trust less apps and sites post snowden disclosure.
    thanks for wasting 2-3 minutes reading my reply.
     
  18. Tiger-1

    Tiger-1 MDL Guru

    Oct 18, 2014
    7,108
    8,779
    240
    for all members that is new here: Hmm Daz has already guided us from the "problem" years ago and so we must follow the guidelines of who KNOW what they are talking about; still remembering that it is part of the Main Administration myself I always followed and never had any problem just my 2 cents ;)