Loading…
24
Shoutout to the guy on r/netsec who pointed out my password manager was pointless without 2FA
I always thought a long random password was enough on its own, but he showed me a stat from Microsoft saying MFA blocks over 99% of account hack attempts. So now I'm curious, does anyone here use a hardware key like a YubiKey, or is an authenticator app good enough?
1 comments
Log in to join the discussion
Log In1 Comment
skylerrobinson22h ago
Something a lot of people miss is that the 2FA itself can get phished too. Some fake login pages grab your password and the one time code in real time and then log in as you before it expires. Authenticator apps are way better than SMS but they still fall for that trick. A hardware key like a YubiKey stops that because it checks the actual site address, so it won't hand over your login to a copycat page. That said, going from nothing to an app is a huge jump in safety already, and most people are fine there unless they're a big target.
4