Post #1492320

2026-04-21 06:07 UTC

No, you did not send a numeric code to my email to help me sign in &quot;for my security.&quot; You did it because you couldn&#39;t be arsed to implement proper app-based authentication. Control of any email address collapses down to a single factor for authentication. Do better. #TuesdayCyberGrouse

Replies (6)

@ar1@mastodon.social 2026-04-21 06:49

@Tarah Yes! You speak my mind. Every single one of these companies messing up login with stupid ideas need to be kicked in their CEO.

Open ##1840940
@trantion@masto.ai 2026-04-21 09:00

@Tarah My favourite is a website I recently stayed using that says it's sending a "2FA code" to your email. They don't let you set a password.

Open ##1840941
@apzpins@some.apz.fi 2026-04-21 13:43

@Tarah Did anyone think of the children?! No wait, wrong bullshit reason!

Open ##1840945
@chrisp@cyberplace.social 2026-04-21 14:04

@Tarah An email provider *could* require 2FA to view your email in a web UI (And maybe also with SMTP) but I haven't heard of any doing that.

Open ##1840946
@chillybot@infosec.exchange 2026-04-21 20:05

@Tarah Prreeaacchh

Open ##1840947
@dfs_comedy@mastodon.social 2026-04-22 00:07

@Tarah Yep! TOTP is widely-supported and super-easy to implement. There's no excuse not to use it as a second factor. The Canadian government finally implemented it on the taxation web site. But my bank still doesn't support TOTP.

Open ##1840949