Re: google account say it will no longer deliver email
On Sat, 14 May 2022 07:25:36 +0200
<tomas@tuxteam.de> wrote:
> On Sat, May 14, 2022 at 03:05:11PM +1200, Ash Joubert wrote:
> > On 14/05/2022 00:42, Michael Stone wrote:
> > > On Fri, May 13, 2022 at 07:16:11AM +0200, tomas@tuxteam.de wrote:
> > > > A loong password is not "equivalent" to 2FA, that's right. Good
> > > > password management (of which length is but a part) is as secure
> > > > as 2FA.
> > >
> > > No, it really isn't.
> >
> > A good password will not protect you from password reset via a weak channel
> > such as email on an insecure server.
> >
> > 2FA will not protect you if the second factor is weak or resolves to the
> > same device. Hint: if you store your password and TOTP key in the same
> > manager then you have only one factor.
>
> Not to speak of SIM spoofing or social engineering of your mobile phone
> provider (yes, it has been observed in the wild). There goes your SMS
> second factor.
Once again, it is well understood (although, bafflingly, often not by
those who should care, such as financial institutions) that SMS is a
terrible choice for 2FA. Hardware tokens, or at least authenticator
apps, are far better. (Although as others have pointed out in this
thread, if your auth app is stored together with your password, that
can eliminate some (but not all) of the benefits of 2FA.)
--
Celejar
Reply to: