| ▲ | pandorobo 9 days ago |
| Very short, badly written article.
It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA. |
|
| ▲ | donatj 9 days ago | parent | next [-] |
| You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication. |
| |
| ▲ | pandorobo 9 days ago | parent | next [-] | | Clearly I didn't misread that. It's literally the very first bullet point? | | |
| ▲ | Thorrez 9 days ago | parent | next [-] | | The first bullet point is "Enter an email address or phone number". That's not MFA. MFA stands for multi-factor authentication. If the authentication only requires a code sent to an email OR phone number, that's just a single factor. | |
| ▲ | 9 days ago | parent | prev [-] | | [deleted] |
| |
| ▲ | M95D 9 days ago | parent | prev | next [-] | | But then, email always was the only authentication. On any site, click "forgot password" and promptly they send you a reset password link. Very few sites have a challenge question. | | |
| ▲ | ClikeX 9 days ago | parent [-] | | Could be worse, I still sometimes get my password emailed in plain text by companies when I do that. |
| |
| ▲ | pandorobo 9 days ago | parent | prev | next [-] | | The first bullet point mentions phone number. - Enter an email address or phone number Thats not just email, that's also SMS. | | |
| ▲ | eddythompson80 9 days ago | parent [-] | | Email OR SMS is still one factor. Its not multiple factors. How are you not getting that? Do you know what MFA means? | | |
| ▲ | max__dev 9 days ago | parent [-] | | Even if it was Email OR password, that would still be one factor due to the OR. I do not think they are discussing in good faith. |
|
| |
| ▲ | Ferret7446 9 days ago | parent | prev [-] | | > It's about email as single factor auth, which has become very trendy of late I must be in the wrong bubble, I have not encountered any site that does this since the 2000s. It was a minor trend around then IIRC. | | |
| ▲ | eddythompson80 9 days ago | parent | next [-] | | Anthropic is the main one. Its pushing a lot of others to do the same. I literally was arguing against that 2 weeks ago and the person who was pushing it said "Claude does that. Its really slick, no password to remember". Patreon can do that too, depending on how you sign up. | | |
| ▲ | moi2388 9 days ago | parent | next [-] | | It’s not slick at all. Passwords and MFA autofill, their image codes don’t, so I have to close the browser, go to email, copy code, delete email, go to browser, paste code just to login. The entire email login flow is completely retarded. It’s not even secure. | |
| ▲ | const_cast 9 days ago | parent | prev | next [-] | | A lot of services just do this de-facto, where you only need an email code to reset the password. Which is equivalent to single auth with email. Email link to reset is better, email link + another auth (usually sms) is even better. | | |
| ▲ | eddythompson80 9 days ago | parent [-] | | Only in an abstract threat model sense. In real world phishing its pretty different. Its super odd if you land on facebook.com-profilesadfg.info/login thinking its just Facebook and try to login but get a "password reset" email. Most people would be confused as they don't want to reset their password. Having it for every login means that just missing the website URL, everything else is 100% legit. |
| |
| ▲ | vachina 9 days ago | parent | prev [-] | | It’s not just slick, it is “secure” on the get go by thwarting any password stuffing attempts (if your email is not pwned already) |
| |
| ▲ | baobun 9 days ago | parent | prev | next [-] | | I believe Slack popularized this back then and still do it. | |
| ▲ | gopkarthik 9 days ago | parent | prev | next [-] | | In India, almost all websites & apps, send a OTP to either mobile or email & ask you to enter that to login. Most of them have even disabled password based login flows. Really grinds my gears. | |
| ▲ | wvenable 9 days ago | parent | prev | next [-] | | Spotify just started doing this. I even have a password saved in my password manager but instead of asking me they just sent an email with a code. | |
| ▲ | daemin 9 days ago | parent | prev | next [-] | | Booking does it and it frustrates me to no end. | |
| ▲ | ErneX 9 days ago | parent | prev [-] | | Trip.com does this. |
|
|
|
| ▲ | ipython 9 days ago | parent | prev | next [-] |
| The first factor is access to your email. The second factor is…? |
|
| ▲ | wodenokoto 9 days ago | parent | prev | next [-] |
| The article is not about multiple factor authentication. It’s about single factor, password logins, using a one-time-token |
|
| ▲ | max__dev 9 days ago | parent | prev [-] |
| The article is not about MFA. It is about using email as a single factor. |
| |
| ▲ | pandorobo 9 days ago | parent [-] | | Thats simple a lie or you didn't read the article. The very first bullet point states: Enter an email address or phone number That insinuates email OR SMS. It doesn't just mention email only. | | |
| ▲ | max__dev 9 days ago | parent | next [-] | | The following is copied from wikipedia. The authentication factors of a multi-factor authentication scheme may include:
1. Something the user has: Any physical object in the possession of the user, such as a security token (USB stick), a bank card, a key, a phone that can be reached at a certain number, etc.
2. Something the user knows: Certain knowledge only known to the user, such as a password, PIN, PUK, etc.
3. Something the user is: Some physical characteristic of the user (biometrics), such as a fingerprint, eye iris, voice, typing speed, pattern in key press intervals, etc. Email and phone are both in category one, comprising only one unique factor. | |
| ▲ | sophiebits 9 days ago | parent | prev | next [-] | | Half factor authentication, then, since either one will work. | |
| ▲ | anonymars 9 days ago | parent | prev | next [-] | | What is the minimum number of things you need access to in order to log in? If you have access to the phone, you can log in. OR if you have access to the email account, you can log in. You don't need to know the user's password, you only need access to one of these inboxes and nothing else. One-factor authentication, but worse, because there are multiple attack surfaces. | |
| ▲ | stavros 9 days ago | parent | prev [-] | | It's still a single factor. | | |
|
|
