2

I have read 2FA adds a beneficial layer of security when logging into accounts. However, many organizations often ask me if I would like to trust the device that I am using permanently so I don't have to receive a text on my phone when logging in.

Does trusting a device effectively mean I'm not using 2FA? Or are the security benefits provided by 2fa still present if I trust my device?

0

No, it won't negate the advantages of 2FA, even if it reduces it a little. Security is only effective if it does not makes the user resort to workarounds, otherwise they won't use the security option. I would not use a 2FA token if it took 5 minutes to arrive, for example.

In this case, remembering the device for a while will not force the user to enter the 2FA token on every request, and will protect the user if his password leaks somehow. An attacker exploiting this perceived weakness would have to compromise the device itself.

And if you value your security, please don't use "token by SMS", "token by phonecall" or anything that uses your phone number to send the token. SIM swap attacks are real, and lots of people are losing access to their accounts because of it.

  • So then 2FA by email is preferred? – Stan Shunpike Aug 26 at 20:13
  • Or an authentication app? – Stan Shunpike Aug 26 at 20:21
  • I suggest using an authentication app, one that allows you to backup the tokens somewhere. I use Enpass, and it's nice. Others include Authy, 1password, keepass... – ThoriumBR Aug 26 at 20:59
0

It depends. Yes, it sort of defies the whole purpose of an added layer of Security that 2fa provides. As, in case of a compromise of the "remembered device" somehow (though could be extremely rare or unlikely), ultimately you lose your account access as well.

That said, it would be a bit cumbersome, considering conveniency, to have to go through an extra layer every time you want to access your account from your everyday-use devices.

So, at the end of the day, it's a choice between conveniency and Security. If you're too paranoid and skeptical about your accounts or data, you might have to give up on ease-of-access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.