2FA or Not 2FA

> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can break into my ssh account or gmail account protected by such a password.

Oh dear. The issue isn’t the brute force, it’s that the online services leak and get cracked. And in an instant a single script takes the newly discovered username password combo and starts hammering it into the top 10000 websites, all within moments of the leak data becoming available.

Your super secret favourite phrase is worth crap once leaked alongside your email address.

Further don’t choose Microsoft for your Auth app, Go with an open source option, maybe one that encrypts and syncs so you have multiple devices just in case.

I agree with the article. Maybe businesses are trying to protect themselves, but as a user, mandatory 2FA reduces the level of security I can achieve for myself.

Because security is not just confidentiality, it's also availability: the "Security CIA Triad" is Confidentiality, Integrity, and Availability.

If I can lose access (availability) to my online account by losing some physical item (e.g. lost cell phone), or if some third party can prevent me from accessing my 2FA (e.g. banned from my email provider by DMCA takedown request), then I have my availability, and hence overall security is at risk.

Additionally, requiring a phone number for online services means that the confidentiality of my identity is reduced. It becomes impossible to be anonymous. For instance, you can't use Signal messenger without a phone number, so there's a chance your identity can be leaked.

Author doesn't understand problem space at all.

1) Weak passwords are not ok even on throw-away accounts. Just because you have no use for it, doesn't mean nobody has. Sending spam, or impersonating you or some other creative use.

2) Nobody is going to bruteforce your password. We don't use md5 anymore. You password will get stolen. By phishing, malware, social engineering, password reuse etc.

Password re-use is the bigger issue.

No one can crack your super-strong multilingual password. But if a service accidentally leaks it, then it doesn't matter.

Credential Stuffing is how 23andMe were hacked. People reused password, they were leaked from another service, attackers tried them on a variety of sites until they hit the jackpot.

Unique passwords prevent that attack. Can't remember a thousand different passwords? Use a manager.

Don't want to use a manager? Switch on 2FA. Weak passwords and password reuse ceases to be a problem.

Yes, as the article points out, it slightly reduces ease of login. But that seems like a sensible trade off.

There is another issue with all those growing 2FA/MFA protected accounts: managing your unexpected death.

How do you teach your beloved ones to access your accounts. And they need to remember what to do. For some accounts may it doesn't matter. For others that means to be able to end the subscription. Because not all subscriptions are associated with a credit card, which just expires.

But if you allow to contact a company by a third party to cancel and or change things then this becomes the go to for social engineering.

I thought he was going to mention the stupidity of sites like Twitter that when you add SMS as a 2FA option you can now use that to bypass the password and so are vulnerable to sim hijacking, which given how incompetent phone company employees are makes your security weaker.

Always use an authenticator app or physical key, most sites that do SMS 2FA will then allow hackers to use it to bypass knowing your password.

> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances.

This felt like the author bending over backwards to justify their choice. They find 2FA less convenient and conflate it with being less secure. It’s not the same thing.

It’s OK to say “not all my accounts are equally important and I need to access some of them in situations where 2FA and complex passwords aren’t worth it”. It’s not OK to sell the idea that 2FA does not generally offer security.

This reminded me of the “SEO expert” a few years back which was trying to convince everyone, with wrong information, to not use HTTPS (which, I realise only after writing this, the author’s website also doesn’t use).

This assumes that services are handling your password responsibly and not e.g. storing it in clear text in a public S3 bucket, which in practice happens all the time.

He's not wrong. I use a password manager that stores passwords only locally, not in the cloud. I can generate arbitrarily complex passwords and never have to worry about how hard they are to type or remember.

2FA makes my workflow significantly more difficult. As a result, for non-critical sites, I have started allowing the browser to store my passwords, thus relying on the 2FA-authenticator for security. This result is likely less secure overall, since the browser's password storage could realistically be compromised.

That said, I do have to acknowledge the point in another comment that phishing may be the bigger threat. Log into a fake site with a password but no 2FA, and you are toast.

This is compounded by the fact most 2FA implementations are security theater not phishing-resistant, the sole exception being FIDO2/Webauthn (e.g. Yubikeys), and Passkeys, but passkeys are really single-factor authentication. Both FIDO and passkeys have serious usability challenges, though.

What's worse, the most common scheme, SMS-based authentication can lead to denial of service, e.g. you are roaming and do not have access to texts, or have your account SIM-jacked as this seems to be very popular way to steal people's cryptocurrencies.

Plus many want your phone number or some random app by them on your phone for their 2FA (instead of e.g. TOTP that you contol), less secure because they now can leak your phone number or do something with an update to the app

BTW what's the sentiment on passkeys?

There are really two aspects two 2FA:

1: you as a user might want to protect your account

2: A website provider wants to secure their own business

If it's about 1, then the argument "I don't reuse passwords" hold some water. It doesn't protect you from somebody getting access to a plaintext copy of your requests (for example on the load balancer that terminates the TLS), but that's only a small part of potential attack surfaces.

But from the perspective the website owner, they might suspect that many of their users reuse passwords between sites. 2FA is a great defense against that, and also against brute force attempts.