Nice, now I have to carry my fucking phone around with me every time I want to check my fucking work emails because some prick at IT decided to force everyone on to two-factor authentication in order to interact with the mail server. So much for choosing

Posting mode: Reply [Return]
Name
Email
Subject	Spoiler Image
Comment
Flag
File
Embed
Password	(For file deletion.)

File: 1625130121380.jpg ( 37.62 KB , 900x506 , social-coercion.jpg )

Anonymous 2021-07-01 (Thu) 09:02:01 No.9689

Nice, now I have to carry my fucking phone around with me every time I want to check my fucking work emails because some prick at IT decided to force everyone on to two-factor authentication in order to interact with the mail server. So much for choosing to opt out of mass surveillance and the socially-malignant perpetual connectedness of carrying a phone everywhere. So much for email being convenient.

It disgusted me when Google and other Silicon Valley monopolies started forcing 2FA on people because I see it as little more than an excuse to coerce people into giving up contact information to better track and surveil them. What's the real deal with two-factor authentication? Why is it seemingly impossible to find an article critical towards it on a simple web search?

Anonymous 2021-07-01 (Thu) 10:15:14 No.9692

File: 1625134514686.jpg ( 53.09 KB , 1024x487 , 1024px-RSA_SecurID_SID800.jpg )

Most of the criticism show you how hackers can break 2FA. For example, someone ports your number away from you and then they receive the 2FA codes. There was also this case of 2FA codes being sent via voice. The hacker would call the person just before the 2FA code was sent, so it would go to voicemail. Meanwhile, the phone company left the default password on the voicemail server, so the hacker could access the code through voicemail.

If your IT department was serious about 2FA, they should use security tokens that are almost impossible to hack and don't require a phone.

Anonymous 2021-07-01 (Thu) 11:34:25 No.9694

>>9692
>use the secure token
For some reason we have to try out all the insecure authentications, and only when all of that has failed is it allowed to do the secure thing and use a token

Anonymous 2021-07-01 (Thu) 11:51:19 No.9696

>I see it as little more than an excuse to coerce people into giving up contact information to better track and surveil them
You aren't wrong, your IT department is retarded.
https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html

Anonymous 2021-07-01 (Thu) 12:00:26 No.9697

>Why is it seemingly impossible to find an article critical towards it on a simple web search?

We need to break this search engine monopoly over what information is available. It's amazing how you can't find anything critical about entrenched IT shit like "cloud", or 2FA or any reliable information about user data being sold except in obscure mailing lists and niche tech communities.
I hope searx takes off.

Also, "IT departments" are cargo cults a majority of the time. Just blindly following whatever is "recommended" to them through their infra provider like IBM or Oracle, or the cloud providers like AWS or Azure these days.

Anonymous 2021-07-01 (Thu) 18:34:47 No.9702

>>9689
>an excuse to coerce people into giving up contact information to better track and surveil them
Use TOTP instead of SMS.
>Why is it seemingly impossible to find an article critical towards it on a simple web search?
Because 2FA is a good thing. Most people use insecure or reused passwords. Any competent IT department requires it because it massively reduces the risk of account compromise.

Anonymous 2021-07-01 (Thu) 19:19:10 No.9703

I use this for github, no contact information needed, works offline, free software: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

Unique IPs: 6