Dumb problem all sites want both 2 factor and email recovery codes

[uc50ic4more]

I thought 2fa was obsolete? It’s a steady escalation but I don’t use anything resembling financial online

2FA and MFA are terms that encapsulate a few different-but-similar methods: That "second factor" could be a phone, an email address, an app, a hardware key, etc. Just requiring evidence of "something you have, something you know", etc. mitigates so much of what a simple username/password utterly fail at providing.

 

[Allaned]

Because there are scum and scammers the world over, the true identity is being asked for. Lots of places but at some asking for identification is questionable.

 

[wwillson]

I thought 2fa was obsolete?

Both MFA and 2FA are even more important than ever. I used MFA on every site that has it available and most do. Passwords are obsolete.

 

[uc50ic4more]

Both MFA and 2FA are even more important than ever. I used MFA on every site that has it available and most do. Passwords are obsolete.

Quoted and emphasized just so everyone can read it twice.

The nominal inconvenience of an additional layer of security is nothing compared to what you'll go through when your bank account is drained because someone guessed (EDIT: or bought) your password.

 

[wwillson]

I keep seeing the statement here that "you should never use financial apps or portals". I really wish people would stop saying that. Banking/financial apps/portals are very secure IF you use MFA, I don't know of any legitimate financials that don't use MFA and some allow the use of FIDO2 keys, which is as good as it gets. You do trust your financial institution to secure your assets, but you don't trust that they can provide secure use of their app? It's just silly a silly stance not to use secure financial apps with MFA.

 

[Rmay635703]

2FA and MFA are terms that encapsulate a few different-but-similar methods: That "second factor" could be a phone, an email address, an app, a hardware key, etc. Just requiring evidence of "something you have, something you know", etc. mitigates so much of what a simple username/password utterly fail at providing.

I’ve had 2fa rejected as being “good enough “ which is why I question it

It's just silly a silly stance not to use secure financial apps with MFA.

I don’t make any payment or access financial data online. In the case we’re things get messed up it’s a lot harder to get fixed than if you keep yourself and your own equipment off line.

The circumstances where I have had issues it’s always an internal or hacking of a 3rd party situation

 

[barryh]

Conducting any transaction online is inherently very, very, very insecure so structures need to be put in place to secure data and identity. 2FA is by FAR, as of this writing, the best way to achieve this. Convenience and security often have an inverse posture. It's not "Discriminatory" because you can't figure it out.

I didn't complain about 2FA and recognise that it's needed. What I complained about was platforms saying you can't use our services unless you have a smart phone. I have one and use it but some people don't and that is discriminatory. The more enlightened platforms are able to implement 2FA by other means.

 

[JohnnyJohnson]

Wait until they start asking for you to scan your enhanced ID!

 

[Rmay635703]

Wait until they start asking for you to scan your enhanced ID!

It’s steady escalation because the id methods aren’t addressing the true source of the issue .

I expect it will keep getting more exotic as each method becomes ineffective

 

[SC Maintenance]

I keep seeing the statement here that "you should never use financial apps or portals". I really wish people would stop saying that. Banking/financial apps/portals are very secure IF you use MFA, I don't know of any legitimate financials that don't use MFA and some allow the use of FIDO2 keys, which is as good as it gets. You do trust your financial institution to secure your assets, but you don't trust that they can provide secure use of their app? It's just silly a silly stance not to use secure financial apps with MFA.

Lots of examples of people loosing there accounts by people convincing the cell phone company they are you and having the phone number ported, then using 2FA to get in.

There are obvious solutions to this - like never use your email as your user name because then all they need to know is your email and phone #, but of course some places make you use your email as your user name.

Security is as good as whomever set it up.

 

[Cujet]

Off topic, but going Starlink at your new home?

Starlink is a competitor, but there is gigabit fiber at the road, and the fiber company is willing to run it the 1000 feet to the house without charge for the fiber run, which won't be easy. So the fiber is both cheaper and faster. Prob more reliable too. Even so, it could be that Starlink would be up and running instantly, where I'd have to wait for at least a month for install.

 

[Pew]

Starlink is a competitor, but there is gigabit fiber at the road, and the fiber company is willing to run it the 1000 feet to the house without charge for the fiber run, which won't be easy. So the fiber is both cheaper and faster. Prob more reliable too. Even so, it could be that Starlink would be up and running instantly, where I'd have to wait for at least a month for install.

1000ft no charge to one residential is crazy. We just paid $3000 to trench a dedicated fiber run from the dmarc box 20ft outside the building to the mpoe, then 20 ft inside the exterior walls.

 

[SC Maintenance]

1000ft no charge to one residential is crazy. We just paid $3000 to trench a dedicated fiber run from the dmarc box 20ft outside the building to the mpoe, then 20 ft inside the exterior walls.

They might be obligated. In order to get access to public easements they have to cut deals with the local governments - like they will service all residential customers or whatever.

 

[Rmay635703]

It looks like nearly all “ISPs” have eliminated email as apart of service.

Those left appear to be trying to do a rug pull to extract $4.95/month by locking your account driving a paid service call periodically.

The timing of all my accounts locking the same day is convenient and the elimination of any ability to get support is convenient. Email services appear to now want you to sign over your life to open an account or fix an existing one.
Every place I’ve ever been forced to provide private data like drivers license, etc has always gotten hacked and breached.

The big players like Gmail have a lot of bad elements.

AOL is bad but I’ve had the account since I was a kid. I guess my fbook, aol and yahoo accounts will go the way of my Gmail account.

I will only be able to use internet as a guest without accounts from now on.

My belief is we should be making broad collection of private data broadly illegal, increasing tracking and biometrics doesn’t help me personally and based on current events is actually increasing fraud. (Thus Ineffective)

 

[SC Maintenance]

It looks like nearly all “ISPs” have eliminated email as apart of service.

Those left appear to be trying to do a rug pull to extract $4.95/month by locking your account driving a paid service call periodically.

The timing of all my accounts locking the same day is convenient and the elimination of any ability to get support is convenient. Email services appear to now want you to sign over your life to open an account or fix an existing one.
Every place I’ve ever been forced to provide private data like drivers license, etc has always gotten hacked and breached.

The big players like Gmail have a lot of bad elements.

AOL is bad but I’ve had the account since I was a kid. I guess my fbook, aol and yahoo accounts will go the way of my Gmail account.

I will only be able to use internet as a guest without accounts from now on.

My belief is we should be making broad collection of private data broadly illegal, increasing tracking and biometrics doesn’t help me personally and based on current events is actually increasing fraud. (Thus Ineffective)

Everyone is using free email services hence you are the product.

If they banned data collection there would be no free email services.

There are some good, secure email services that apparently don't sell your data. Proton mail for example will even give you a free email they just limit storage, so assuming you can keep it cleaned out that might be an option.

Honestly I have had 2 yahoo and one gmail account for literally decades without issue.

 

[Rmay635703]

Everyone is using free email services hence you are the product.

If they banned data collection there would be no free email services.

There are some good, secure email services that apparently don't sell your data. Proton mail for example will even give you a free email they just limit storage, so assuming you can keep it cleaned out that might be an option.

Honestly I have had 2 yahoo and one gmail account for literally decades without issue.

Is it free if I need a drivers license, CC and ?? To create the account, aol and several others want lots of personal info now.

Mine constantly get locked, I rarely use them and they go into recovery requiring a hassle, just not this much hassle, usually one works to get back into the other. AOL I have had since 1988 without issue until 2016 when I couldn’t stop a hacker from constantly getting into it
but it too has been driving ever increasing incidence of being locked since I’ve added 2fa

Gmail was a fiasco so I won’t touch that

 

[SC Maintenance]

Is it free if I need a drivers license, CC and ?? To create the account, aol and several others want lots of personal info now.

Mine constantly get locked, I rarely use them and they go into recovery requiring a hassle, just not this much hassle, usually one works to get back into the other. AOL I have had since 1988 without issue until 2016 when I couldn’t stop a hacker from constantly getting into it
but it too has been driving ever increasing incidence of being locked since I’ve added 2fa

Gmail was a fiasco so I won’t touch that

Like I said, you can give up all your information and get "free".

Or you can pay. Or set up your own. There are a few that can be free and somewhat limited privacy intrusion if you limit your storage. There hoping you don't.

So of course not - there is and has never been a free lunch.

 

[Rmay635703]

Like I said, you can give up all your information and get "free".

Or you can pay. Or set up your own. There are a few that can be free and somewhat limited privacy intrusion if you limit your storage. There hoping you don't.

So of course not - there is and has never been a free lunch.

I figured if I’m paying megabucks for high speed
email should be in said price

Said isp already stole part of my private data, is physically available to reach out to for support, etc

It feels criminal having spread my info out on more sketchy online places because the email part that also provides evidence of my being a real human is no longer under the same roof in alignment.

Years ago the main point of the isp was email.

 

[SC Maintenance]

Years ago the main point of the isp was email.

Yes, and when you moved you lost access to this email account because that ISP did not exist in the next place. Many of those small ISP's long went under, hence all those emails are gone.

Its convenient to keep an email for decades. So your choice is the big tech data mining crowd, or pay to set up your own.

Whats wrong with Proton Mail?

I figured if I’m paying megabucks for high speed
email should be in said price

Cost of high speed internet is a different problem. I agree were to a point that is a giant rip off. Not sure the solution, hopefully the combination of starlink and 5G will provide some actual competition. Most can't be without it and they have only one provider option for hard wired. When my daughter was in an apartment in the city she had 3 options, and paid 1/3 for actually better service than I get.

 

[wwillson]

Anyone can buy a domain and set up your own email server on a cheap VM or a Raspberry Pi. I used to do that and it became more work than it was worth, but it can be done.