Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't particularly love gmail and I'm personally trying to switch to fastmail over time, however I am on google's side this time around. There are reasonable approaches that can address this librarian's concern. Backup codes, backing up the MFA seed. She talks about patrons having cell service shutoff, but that doesn't affect google authenticator. There are good reasons why google went to an MFA only model and yes there are some downsides, but they're not unmanageable.


MFA is a great option to provide, and I would even suggest it should be default on, but what's the harm in allowing the user to opt out of MFA?

If available, it seems to me it would be the best option for this demographic.


At least one reason: cyber-security insurance policies are starting to mandate MFA, because they are tired of paying out on insurance claims.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: