EDIT: After reading all the responses, I’ve decided to allow cookies to persist after they close the browser, which I expect will make it so that 2FA doesn’t kick in as often, at least not on their most frequently used web sites. I may also look into privacy oriented browser extensions that might offer some protection, such as Privacy Badger. Thanks, all!
OP: I know two factor authentication is considered more secure than just passwords, but here’s the deal: One of my family members uses Linux Mint on their laptop (at my recommendation and yes, they are aware that it’s not a Mac), and while they’ve mostly adapted to the different workflows (coming from a macbook), one of their biggest pain points is that web sites are constantly challenging them because they don’t recognize their machine. It’s frustrating to them because they used to just allow all cookies in Safari, whereas I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed. I know this isn’t a Linux/Firefox issue, but I think they might not see it that way and I worry they’ll get frustrated to the point that they’ll go out and splurge on a new macbook air when they already have a perfectly functional laptop with functional OS.
Right now I’m thinking of adding their most frequently used web sites as exceptions in Firefox settings so at least those cookies would persist after closing the browser, making them easier to log into. Or maybe I’ll just allow all cookies indefinitely, although I’d rather not just throw in the towel on Big Surveillance. Is there another way to walk that line between convenience and security that I’m not thinking of? Should I just remove my tin foil hat and allow all cookies indefinitely?
Thanks in advance for your advice.
Thanks for your advice, and yes, they use a password manager (KeepassXC), but this is the first I’ve heard of web sites that support pass keys. I’ll look into that, thanks for the tip.
Passkeys are the newest hype. Question is whether they’re really safe, and how simple end users will deal when problems with it arise. I’d say go for allowing cookies and use the 2FA you already have configured.
FIDO2 has been around for a minute, it just got better branding and mainstream interest. Safe vs passwords is kind of silly, workflow for problem solving is a concern though (although not all that different than 2FA issues, they even use the same token in many cases).