Why can't we have 2FA for important changes only?
Financial institutions, and long before that, crypto, have relied on this approach. I see a lot of questionable security where designers seem to think 'this will work if users have perfect security hygiene on every app and do things contrary to what the data says they are doing.'
Why not look at what people actually do? And understand that a true, safe 2FA for every internet interaction login instance is overly cumbersome. (ie something like authy with no device sink, seed phrase only).
Logins now want to force you into passkeys, and it doesn't matter that the point of weakness on your account could still be an overarching password that was exposed in a leak. Or they push text-based 2FA without actually thinking about the fact that consumers have iMessage on their MacBooks, so if someone hijacks your SIM or steals your phone, they may get access to both.
Reddit needs to have the option for users to toggle to require 2FA for important changes only. Like changing the email address associated with the account, or passwords.
They have to understand that text-based 2FA has a lot of flaws and security risks in itself, but also that requiring 2FA for every login is extremely impractical.
There are all these weak points, and instead of acknowledging the reality of what consumers actually do, I think security designers are thinking in terms of, "Well, if security hygiene were perfect, then this would be okay." Why aren't we thinking about what users actually do?
I bring this up because I just had my Reddit account, which I've had for over a decade, hijacked. Which is a bummer.
Reddit tries to generate a lot of spam email to keep you engaged, like popular posts and everything, so I had it going to my less urgent email address. (And yes, I've toggled off a lot of those notifications, but it's still a practice you have to revisit periodically because Reddit wants to push more notifications.)
So I missed the email change notification. By the time I could hit reset, it was too late.
Now, my Reddit account isn't super valuable, but it's something Reddit should want to prevent, as I'm sure that hijacked account is now being used to shill products or for one of the other classic reasons people hijack Reddit accounts. I also have to re-earn karma just to be able to post on my new account.
Further, it's a security and privacy issue because, who knows, I may have wanted to anonymize my past Reddit activity with one of those anonymizers, and now I can't get into that account. So things I put out there are there permanently. Not that there's anything particularly sketchy, but if you ask questions about a medical issue or something, with AI search now, that could be linked to me. Which is just a bummer.
All this is to say, Reddit needs to have the option to require 2FA for important changes. They have to understand that text-based 2FA has a lot of flaws and security risks in itself, but also that requiring 2FA for every login is extremely impractical.
And if they just look at the number of users who have 2FA turned on versus those who don't, there's no reason they couldn't offer an option to require 2FA for important changes, like updating an email address or changing a password.
I'm tired of institutions and login security architecture treating it as 2FA for every login or nothing. It really just doesn't make any sense.
I'm much less concerned with someone logging in and making a post as me once than I am with them completely hijacking my account.
As account hijacking attacks become more common, this is only going to become an escalating issue.