MFA grind

You'll lose many more years if your accounts with sensitive content ever get compromised.

Every time I read comments on posts like these, it reaffirms to me how the average person does not give a shit about real security or is completely ignorant to how and why these extra safeguards are used. Lemmy, I would assume, has a higher than average tech knowledge amongst it's user base vs many other platforms, but the sentiment often that of, MFA and needing to login to a bunch of separate applications is too much work and the people that designed them don't know what they're doing. It's a bit disheartening.

nah, you can care about security and also lose hours on MFA. for global enterprise, the overall user experience is far from optimal imho.
- Another bigass reason why godaddy sucks lol
- Yes, I can't defend dog shit implementation. There are enough authenticator apps available that anyone reputable should use one instead of the less secure email or SMS.
Do I really need TFA for social media? Or a forum? News sites? Fucking weather? Financial logins I get, but every single site requiring it is a cumulative time and hassle burden that is not worth it.
- I would say anytime where someone can impersonate you or make purchases as you deserves MFA. That's my risk tolerance, but it can differ obviously. I just feel that threshold is too low for a lot of people.
- …for social media?
  Where someone can impersonal you and scam people out of money? Yes. 2FA.
  …Fucking weather?
  I mean, I’m not here to kink shame but, probably? I’m partially wondering now what weather looks like when it fucks. Like a tornado in a sinkhole?
  …every single site requiring it is a cumulative time and hassle burden that is not worth it.
  It wouldn’t be necessary IF:
  People chose decent passwords that were different for every login
  Website security was taken seriously by anyone who has a login.
- I don't mean to sound rude but why would you need an account just to check weather
At work I need multifactor for everything, but... ITS ALL THE SAME MICROSOFT ACCOUNT. We have SSO, but every single stupid webpage needs me to sign in separately with 2FA and forgets about me hours later. It's needlessly tedious.
I just use strong, unique passwords and be mindful when something is asking for my logins.
- That should be the bare minimum for everyone, but it doesn't protect anything if a password is compromised, especially something like email that can lead to getting other passwords.

A minor annoyance now to avoid a major headache later. Worth the trade

No sso?
Same, but also add MFA to log into laptop.
I've had good luck with bitwarden. It copies autofills the username and password, then once you submit, it copies the 2fa to your clipboard.
of course, it's a pro feature, so you'd either pony up or host vaultwarden assuming you can even install the plugin on your PC.
- I don't think that's an option at work
Why not HSM?

The galaxy-brain move is to store the password in a password manager, and also have the same password manager store the TOTP. Finally, you set your password manager to unlock by biometric authentication

All of a sudden, you're set by just showing your fingerprint to the reader.

Only downside is that you can more likely be compelled to give up biometric authentication than a password (as far as I understand)
- This is a threat I'm not planning to handle.
- Very true. But most of the places that will compel you also have no issue just compelling the companies you have accounts to give you up.
I have a very secure password protecting my password manager, and have set up all my passwords there to 123456

Well, maybe. You said years plural, so let's take just two years. 2 years * 365 days a year * 24 hours a day * 60 minutes an hour is 1,051,200 minutes in two years.

Let's say that every time you use 2FA it's an extra 2 minutes. How many times a day do you use 2FA? That's probably the biggest variable. For some people it's a couple times a week, for others it's several times a day. Let's say 5 times a day. We also need to know how long you've been using 2FA. That's going to be another big variable. Does 5 years seem reasonable? If so, 5 years * 5 times a day * 365 days a year * 2 minutes each time = 18,250 minutes wasted on 2FA.

That's a small fraction of the million minutes in two years, but it could change a lot depending on some of the variables.

But on the other side, if even one time the 2FA stopped you getting your account hacked, the calculation would change a lot.

The MFAs using an authenticator are torture.

Do you like the ones sending you a text better?
For me they're worse. You need to have reception. And SIM cloning/swapping/stealing is something that is a thing too.
That can't happen with an authenticator app.
Yeah, opening an app and typing 6 numbers? Way too much work. Also why can't my password be 'password' like the good old days?

lost your password? time for a scavenger hunt!

What was the colour of your childhood best friend's hero's first car?
- Blue! No, yellooooooooowwwwwwwww...

Passkey

Lemmy passkey wen
- I saw your comment earlier today and thought "heh ok, challenge accepted."
  https://piefed.social/post/762082
i like the idea if username/password with optional passkey as secondary ... ie "something i can keep in my brain" mixed with "something a compute device can do"
having only a passkey doesn't feel like it aligns to a "defense in depth" approach, which we've learned many times over is critical to surviving a single oopsy. someone gets access to your passkey manager (eg phone) then you're fucked.
i'd like layers please!

I'm glad that a pizza place has higher MFA requirements than many banks. We've made good decisions as a society for that to be true.

That reminds me I've gotta change the authenticator for my luggage

1....2....3....4....5

Like with insurance, it's far more worth spending an extra 2.5 seconds on 2fa than it is spending regaining your stolen identity and (potentially) ruined reputation (unless it's text based 2fa)

2.5 seconds? You must be the fastest 2fa grinder

At work, I must to use it every day to open google docs or gmail.