Comment by latexr | Hacker News Reader

Comment by latexr | Hacker News Reader

> Because security is not only about being protected from intrusion, but also about being able to securely access data at any time and in any circumstances.

This felt like the author bending over backwards to justify their choice. They find 2FA less convenient and conflate it with being less secure. It’s not the same thing.

It’s OK to say “not all my accounts are equally important and I need to access some of them in situations where 2FA and complex passwords aren’t worth it”. It’s not OK to sell the idea that 2FA does not generally offer security.

This reminded me of the “SEO expert” a few years back which was trying to convince everyone, with wrong information, to not use HTTPS (which, I realise only after writing this, the author’s website also doesn’t use).

Security is about risk management. If the value of what you’re protecting is low, or the consequences of not accessing something is high, than the MFA control may not add value.

The problem is in general people are really bad at assessing risk. You tend to see extremes.

If we define data that can't be accessed by anyone as secure, throwing disks in a furnace is how you achieve security.

I don't think this definition is very helpful though. So I prefer the one where the entities that need to have access still can access.

> I don't think this definition is very helpful though.

Because it’s a straw man, and straw men aren’t helpful for discussion. No one is suggesting making data wholly inaccessible.

Data that you cannot access “at any time and in any circumstances” (author’s words) can still be secure. A fairer analogy would have been storing disks in a locked safe in your home. It’s not as convenient to access it, but it is secure. Should you do that for all your data? No, but neither have I advocated for that. I very clearly stated that I think it’s OK to have different levels of protection for different types of data.

If I can't access money that I secured, I didn't secure it properly.

Which has nothing to do with my argument. See the reply to the other user, which expands.

https://news.ycombinator.com/item?id=43421721

Reply on news.ycombinator.com