2026-07-12 17:03 UTC
My general point is that 2fa intends to help with the hop between the user and the service provider, but doesn't help with other hops, and nowadays those tend to be the weakest links. The number of times I've suffered a security incident due to a weak password or getting phished is zero. The number of times I've suffered a security incident due to my service provider getting popped is... well I've lost count. Meanwhile every service provider treats me like a stone age heathen for eschewing 2fa, and increasingly I'm not even offered the choice. That's victim blaming. @mjg59@nondeterministic.computer if by "actual cryptography" you're talking about something like homomorphic encryption that allows service providers to process my data without understanding it, that'd address my concern, but I am not sure entirely what you mean.
Replies (1)
-
@mjg59@nondeterministic.computer 2026-07-12 17:17
@psf@oldbytes.space these are two entirely separate issues - users should not worry about vendors leaking their information, but also even if vendors don't do that then you're still relying on the strength of your users' security. There's no way for a vendor to determine how strong a user's practices are around password reuse or ability to identify phishing, so regardless of how competent *you* are you're going to be treated like someone who uses the same password everywhere and gives it to anyone who asks