Until Mozilla gets Two Factor Auth they should NOT be doing anything with passwords or authentication.
back
3 comments
Persona ameliorates the need for two-factor auth because you have to have control over an email account registered as the provider for Persona to interact with the user.
Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way.
> Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way.
Can you explain this a little more? I don't think I understand, because to me it sounds like you're saying, "once your account is hacked, two factor authentication won't help because your account has been hacked, so the adversary can disable two factor authentication". Don't major changes to accounts like that sometimes require re-authenticating with all required factors? I need to do this if I want to add a bill pay recipient to my bank account even if I'm already logged in.
Social engineering is the most common cause of account hijacking with two-factor. Check this out: they used his cell phone provider to get at his google account.
http://www.makeuseof.com/tag/two-factor-authentication-hacke...
Persona does not require any interaction with Mozilla. If your identity provider wishes to require 2FA on Persona logins, he may do so. Persona is a protocol for signing identity assertions. Authentication is out of scope and thus not defined.
What does 2FA have to do with Persona? Your comment is just uninformed and wrong.