obventio56

I think ignorance is a factor, but also legitimate multi-user solutions might involve a lot more friction than these workarounds (or not exist at all).

Say I have 300 employees and 10% will eventually need to access an account (random sample, unknowable beforehand). Does it make sense to have all 300 create accounts vs just putting the info in a password manager for the 10% and calling it a day?

Of course at this point you should just disable 2FA if you're going to defeat all it's security benefits, but more and more 2FA isn't optional.

To kickoff my own post, solutions I've seen include:

- Using a Google Voice phone number to receive codes and forward them to an email list.

- Using a texting SasS to receive codes (the SaaS, of course, can't require 2FA itself otherwise you're in a pickle)

- DMing the account owner on Slack

- Saving the TOTP key in a password manager

Most of these solutions seem to defeat the purpose of 2FA in the first place.

Antidotal (likely an outlier) but I’ve slowly deleted social apps (Facebook, Twitter, insta) in favor of using their mobile sites. My reasoning is three fold: mobile sites are pretty good, it’s harder for companies to mine my data in a browser, and honestly storage on my 16gig iPhone is far too valuable for a 300mb app!! I’m 18 (aka young and woke) btw.

Side point: I still need Snap’s app but I’ve considered quitting altogether bc it’s barely usable on my 6S. If battery is < 10% my phone will die if I open SC

I can't be the only high school age lurker here that thought your comment came straight out of an AP DBQ.