That seems like an idiot took the copy for two competing internal opinions and pasted them without understanding.

Demanding you to use 2FA? Should be standard in this day and age.

As long as session cookie lasts for, dunno, months. Extended automatically.

Mandating 2FA for every fucking time you use the app, and only using email for 2FA? Special place in Hell. (I'm looking at you McDonald's)

(Could be worse. Could be SMS 2FA.)

I think it might be a bit overkill to require a login to start your car.

Also, being able to manipulate the operation of the vehicle remotely or it announcing its own location at all times doesn't exactly scream 'security' (or privacy) to me.

I feel like whoever screenshotted this cropped a following paragraph telling users to use passkeys... That's the only way this would make sense

In exchange for being able to check what the charge is on our car - basically, whether it's time to leave coffee shop - I get one of the most information-stealing, asks too-many-privileges apps on my phone. And it's quite hard to do without it with an electric car. Looking at you, Ford, although I understand all manufacturers do the same.

MFAA and a password in exchange for eg. an OAuth token so that you can manage the devices on your account, and then use your phone's usual security to control access to the app, would be one thing. But this looks more like the security team has made some demands, and the developers have implemented it in the laziest, MVP-compliant, way that they can.

To help speed up your log in experience, you'll now also need to separately log into another app in order to log into this one in addition to the current method.

It's so smooth

A lot of people in here don't understand security fundamentals.

Passkeys are not bad things. They are good things. 2FA in general is a good thing, and passkeys are a particular type of 2FA.

The principle behind this type of security is, in loose terms, "one thing you have and one thing you know". Historically this has meant a device and a password.

The idea is that stealing just a physical object is easy (lost item, cloned, or theft), and stealing just a single piece of information is easy (leaked database, phishing, etc). Stealing both is much harder.

Passkeys satisfy both by requiring a piece of information to unlock the passkey (a fingerprint, or your phone's password, or your hardware key's unlock code). You need both the physical object where the passkey is stored and the means to unlock that device.

Password managers are not a replacement for passkeys because they are not hardware-bound. A compromised service or server provides full access.

Please use passkeys. They are genuinely more secure than passwords without 2FA.

“I can see you’re trying to adjust your headrest. I can help you with that. To assist me, please log in to your Ford account with MFA…”

I've used this feature once to unlock the car after I forgot the keys inside. It's nice enough to have, but that's about the only scenario I'm likely to ever use for.