Today, the owner of Bearblog Herman finally replied to me, and in detail about the considerations of not implementing 2FA. I am here to quote all the text as it will be worth understanding security in different perspectives and contexts:
This is something I’ve thought long and hard about, and will have to write a post about it at some point.
Bear doesn’t have 2FA by design for a few reasons. The first is that this is a low-priority account. There aren’t concerted efforts by malicious actors to take over blogs since there’s no financial incentive. There hasn’t been a compromised account on Bear for the last 5 years, and even if someone’s password is leaked either via phishing or a reused password in a data leak, there’s not much interest from the malicious actor.
Not to mention that if someone does mess up your blog due to a leaked password, you can email me and I’ll restore your access and roll back the changes.
Adding 2FA would be security theatre here. On top of that, most people are really bad at backing up their 2FA recovery codes, which just means they’ll just email me once they’ve locked themselves out of their accounts asking to restore access. Since you can just email me and I’ll restore account access it kinda negates 2FA to a certain extent (since it’s not a hard lock of the account).
So in a nutshell, I’d be creating more work for myself while trying to solve a problem that doesn’t currently exist on the platform.
I hope this all makes sense. Feel free to ask any other questions
