"Your 2FA authentication has been downgraded to email/password for ideological reasons."
That aside, do you have a recommendation for auth that provides good privacy while also having wide adoption and ease of integration similar to Google or Facebook auth? And also 2FA of course.
If there are no options then I think our problem is bigger than this particular dev's ideology.
They also really should switch from bcrypt to something more modern like argon2, but bcrypt is a lot better than the unsalted MD5 I've seen in a lot of places.
Factor #1 - Thing you have: encrypted password vault.
Factor #2 - Thing you know: password to said vault.
Of course, this is only 2FA from the user's perspective. Meddling websites cannot ensure that you didn't memorize their password, or write it down unencrypted.
- Something you know: password.
- Something you have: your phone or a physical key.
- Something you are: Biometrics (finger-print, eye pattern, gait of your walk, etc.)
Using 2 passwords, such as the case of knowing the password to your vault of passwords, is only 1 factor.
The 2 factors are then the vault itself and the vaults password.
It should be noted, though, this is significantly weaker than "real" 2FA, as normally that would involve some sort of challenge, rather than just storing a hard secret.
Regardless of your feelings on Big Tech and Privacy and whatnot, this absolutely looks like a security downgrade to me. If I were someone looking for para-financial services like this to phish with fake users for fraud purposes, I'd probably start with a site like Slimvoice.
Personally I think there's a good argument to be made about the benefits and tradeoffs to allowing giant cloud companies to control the idea of "identity" on the internet. But if there's any market segment where big companies with deep pockets and extensive technical resources bring value, it's this one.
No, it’s not.
It’s certainly not harder or more complicated than the OAuth protocol used support Google-based sign-in.
Exactly what unique value do you believe these big companies bring, exactly?
Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.
I too don't like third party sign ups, I think they are bad for privacy and the user.