|
As a tech that for some time has been primarily in security, I’ll put some basic thoughts to this.
First, I agree as long as it’s opt out. And, depending on how it’s implemented. (More on that in a moment). But not for the reason the op is thinking.
2FA protects you if your info was somewhere else and you used the same login and password on multiple sites. It generally doesn’t do anything for the site you are currently using.
That said, it has a benefit even if you use wise and proper password security; different credentials on every site.
If a site is compromised, and they take your info and attempt to log in, they can’t do that without your code.
The issue with 2FA comes with how it’s implemented, as well as a false sense of security. Again, let’s pretend everyone is using best-practice security.
PHONE
If you use your phone for a text…. Well, most sites that you would actually want 2FA already also have your phone number. Ghosting a phone number is not that hard. Most people are not protected from it. Even if number sharing is off (it is by default for most phones), you usually need to opt in to porting locks. Sim locks don’t protect you completely from number porting unless you’re on a tier 1 provider in this country. So if you’re on a tier 2 or lower provider, call and make sure you have both sim lock and porting lock.
AUTHENTICATION APPS
These are extremely limited. You need to have the app on more than one device, or like passkeys, you’re locked out if you lose access to the device that has the app. And which authentication app to use? I mean, really. There’s Google, the go-to for Android users. Apple users generally don’t have it and don’t want it. Same in reverse. Do you support password app authentication? Which services? Etc. Too many choices people will skip it. Too few people will skip it. The upside vs the next option is that the big authenticators will allow a way to rebuild on another device.
PASSKEYS
I promise not to rant. Ignore mainstream news. Take a look at the more honest write-ups in tech publications. Passkeys are great until they are not. Passkeys are device dependent by design. One key one device no recovery. Great for security. However, loose access to that specific device, loose access period.
It’s more than just breaking your phone or computer or having it stolen; even buying a new one.
Think about Windows OEM licenses. Or AAA computer games. Replace more than one component, new device id. No more matching passkey. On a phone or tablet: that’s game over even for a minor repair.
New storage chip or ram cell? 2 changes—New key.
New antenna? 4 changes
New screen? That’s a minimum of 12 device changes.
->Never use a passkey unless it’s the only choice. Even then, email, text, or call the company and ask if there is an alternative. We’re overboard for Boardsort, they can probably reset your account. Your bank or payment company probably won’t. But that’s my sincere inside advice: stay away from passkeys.
So here’s my point. I agree, add it for those that want it. Allow us to opt out.
Boardsort doesn’t have anything really worth stealing from users in a hack.
Your address is already public by legal requirement. If you have a driver’s license, state id, utility, anything, you’re in the state database. That’s publicly accessible. Boardsort is the last place they are looking for that, much easier to just bypass the rules and grab it from the state.
And if you have PayPal? Well, your email address is likely already linked to PayPal publicly from any of the millions of hacks over the years. Boardsort doesn’t have anything to offer that a hacker or scammer can’t get elsewhere easier.
_________________
42 6F 61 72 64 73 6F 72 74 2E 63 6F 6D
|
Login
Register
FAQ
