Hacker News Reader

For me to take a company seriously MFA must be in all their plans. MFA is not an enterprise hook for upsell, it is a fundamental requirement for any online service these days.

View on HN

Agreed, MFA is so important that a company should be willing to pay for it.

I and GP comment seem to take the opposite stance: MFA is so important that products like this shouldn't offer a plan that doesn't include it. Either include it in your free plan or don't offer a free plan; don't make security an upsell.

> ...don't make security an upsell.

Especially in a security focused product.

I'm not saying companies won't. But if you want me to believe your security is top notch then you need to show me you take it seriously.

Not offering MFA on the free tier tells me you're more interested in making money than in security.

There are plenty of other features that an enterprise will pay for.

Auth0, Microsoft also have MFA as a non-free thing. Probably because they have to pay for an SMS/equivalent.

It would be good to offer SMS MFA in the free tier, providing the dev plugs in valid Twilio credentials.

Reply on news.ycombinator.com