" post_id=369589 time=1656276890 user_id=346]
Henu the Great said:
How about two factor authentication?
Yes, of course. That is much simpler than the encryption. Most likely 2FA is already done by whatever webmail framework we would use. It's usually very easy, like just sending a random code to your phone, which you enter on your computer when logging in.
But with that said, I don't have much faith in 2FA. It's one of those features that
feels really secure, but it does very little to protect against actual attacks. The only kind of attack it protects against is password-stealing - which is good - but anything worse like a persistent virus gets past 2FA easily. A virus can simply wait until YOU login with 2FA, then hijack the session and do anything anyway. Assuming you use strong passwords and the server stores them correctly, there are very few attacks that can steal your password but can't plant a virus. Phishing is about the only common one, and that can be prevented by using bookmarks.
However, 2FA certainly does help at least a little, so it's a nice feature to provide.