Re: google account say it will no longer deliver email
On Sat 14 May 2022 at 12:02:49 -0000, Curt wrote:
> On 2022-05-14, <tomas@tuxteam.de> <tomas@tuxteam.de> wrote:
> >
> > On Sat, May 14, 2022 at 08:58:37AM -0000, Curt wrote:
> >
> > [...]
> >
> >> What about data breaches, and sites keeping your password
> >> in plain text (though it seems access to the cryptographically hashed
> >> passcodes is already a pretty good leg up)? What good is our entropy then?
> >
> > As stated elsewhere: unique passwords. Don't use a password you're using
> > elsewhere. Much less so with a site you don't trust.
>
> As always, I'm very uncertain where your goal posts are placed or what
> tacit agenda you're following. No one has advocated the use of unique
> passwords.
>
> In my plausible scenario, you're password entropy counts for nothing.
> Your password, unique or otherwise, has been compromised. 2FA would
> prevent illegal entry to your account in this case. The subject we're
> addressing here is your assertion that 2FA adds no extra security. I
> have demonstrated that it does.
Preventing data breaches are outside the scope of the user, providing
a high entropy password is not. If accessing a site is of importance
to him, then, in your plausible scenario, an eight character password
effectively gives little security.
That is not an argument for 2FA but for a user having a responsible
password policy to guard agains such breaches.
--
Brian.
Reply to: