[NumberSix]

I do not like the changes to the 2FA login that have been rolled out very recently. I hope the people at FM realize that making many different choices of 2FA method easily available drastically reduces the security provided by 2FA! We usually consider having more choices a good thing, but in this case, more choices only helps the attacker.

The best security is offered by having only a single method available, and forcing the user to respond using that method. I realize this can sometimes cause trouble for less careful people who might, e.g., have their phone as their 2nd factor, and lose the phone, making it impossible to access their email for a while until it gets straightened out. I get this. I myself (I use Yubikeys normally) have once or twice had to rely on my phone for normal PC browser login because of not having any of my keys at hand.

But the most troubling aspect of what was recently rolled out is that a new method, voice call, was added to what is now a very clear menu offering 3 different options for 2FA. This voice call thing was not there before, as far as I noticed. So now, someone trying to break into my account only needs to have access to my cell phone, to answer a voice call (which is possible without unlocking it).

I never asked for this, and don't want it! I would even be willing to move to a system where only one method is offered, and if I don't have it, I'm SOL. I like that higher level of security. I would still need the auth app method for access from my FM phone app, but there's no reason that app access vs browser access cannot be distinguished.

I suspect that this change was to "make things easier" for the Average l(U)ser, who is clueless about security and merely aggravated by anything that stands in his way when getting into email, but some of us really care about security! At the very least, you should make the menu of 2FA methods offered upon login settable in the settings, so that those of us who want more security can lock things down, and those who want more convenience can leave the defaults.

Not cool, FM. As with so many other features, if you want defaults to be appealing to Average users, at least give us power users the chance to change the defaults, even if it's buried way down deep in the settings!