> You need to have a 2FA authenticated connection or be on a 2FA authenticated device within validity period to change 2FA settings. You can elect to have 2FA not remember the device you have logged into as well (ie, the remember this device for 30 days option) if you are particularly paranoid.
To change security-related settings, it's default practice to double-check even the user's password without 2fa.
> This is a fantastic balance in terms of security and usability.
Sorry, that's plain apologetic bullshit. How often do you enable and disable 2fa? This has nothing to do with usability.
To change security-related settings, it's default practice to double-check even the user's password without 2fa.
> This is a fantastic balance in terms of security and usability.
Sorry, that's plain apologetic bullshit. How often do you enable and disable 2fa? This has nothing to do with usability.