bonifartius 𒂼𒄄
i hate the web. i hate the security theatre. codes via SMS, two factor bullshit apps (on your mobile, which clearly isn't a NSA bug), random account locking because you did something "suspicious" like using an ipv6 tunnel.
@bonifartius What happen with Two factor apps? Just to be in context.
@jrballesteros05 it's just show. especially if the code is generated on the same device the user logs in. in the end it's just another password which gets shoved into a function to create a time based token.
in theory it might be a good idea if done on a different device, but in practice it's often done on one. then it's just a hassle instead of more security, imho.
@bonifartius U2F can be achieve in many ways. Of course it depends on the application. I bitch Google a lot but I have to admit I like the alternatives they have for U2F like touching the phone anytime you login, OTP, USB Key.
U2F is a pain in the ass but in my opinion it's necessary, I wish I could have U2F when this happened to me:
https://fosstodon.org/@jrballesteros05/107263272239128854
Many people implement only OTP because of "comfortability". But sadly people is changing freedom and alternatives for that.
@jrballesteros05 but that would not have happened with a fresh password, as you've written yourself :)
i just want things to work.. i had some random lockouts which all had cost me my most valuable resource, time. i can't stand if i'm locked out of a service and have to wait for customer service to fix things :)
it's fine if services offer u2f, but i don't want to be forced.
@bonifartius I also believe knowledge is good to avoid those kind of problems but I saw many companies spending a lot of money teaching people the minimal of security and how to detect phishing but they still fall in the trap. It's good but sadly it isn't enough.
- I wish I could use my WiFi without encryption and forget passwords, because it makes service slower but we needed.
- In many places have been trying to replace passwords but at the moment isn't still enough.
@bonifartius Security is annoying but sadly is needed. What we always try to do it's to make a system the most secure as we can and the most usable. Too much security is ideal but annoys people because it's less ussable.
A boss in my job told me "Even if it's user fault we have to protect them". In my case it was my fault but a U2F could have saved me even if it was my fault. And I have a knowledge in security. They tried to make a takeover in my account just because I was careless.