#2FA

6 Beiträge6 Beteiligte0 Beiträge heute

N-gated Hacker News🚨 Stop the presses! 🚨 A <a href="https://mastodon.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> app that alerts you when you hit the oh-so-crucial "314159" – because nothing screams "cutting-edge security" like a Pi surprise party for nerds. 🤦‍♂️ Keep subscribing to this riveting newsletter for your fill of code-speak and retro nostalgia. 📈🎉 <a href="https://blog.jacobstechtavern.com/p/building-a-2fa-app-that-detects-patterns" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.jacobstechtavern.com/p/building-a-2fa-app-that-detects-patterns</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://mastodon.social/tags/PiDay" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PiDay</a> <a href="https://mastodon.social/tags/NerdCulture" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NerdCulture</a> <a href="https://mastodon.social/tags/TechNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechNews</a> <a href="https://mastodon.social/tags/RetroNostalgia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RetroNostalgia</a> <a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/ngated" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ngated</a>

🌻Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit 🕵️‍♂️ Teilen erbeten ‼️ :BoostOK: <a href="https://cryptpad.digitalcourage.de/file/#/2/file/C3-dKGz23Qhw1ZSBmDnOAK3s/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://cryptpad.digitalcourage.de/file/#/2/file/C3-dKGz23Qhw1ZSBmDnOAK3s/</a> <a href="https://digitalcourage.social/tags/DSGVO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DSGVO</a> <a href="https://digitalcourage.social/tags/TDDDG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TDDDG</a> ( <a href="https://digitalcourage.social/tags/unplugtrump" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unplugtrump</a> ) <a href="https://digitalcourage.social/tags/Datenschutz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Datenschutz</a> <a href="https://digitalcourage.social/tags/Privatsph%C3%A4re" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Privatsphäre</a> <a href="https://digitalcourage.social/tags/sicherheit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sicherheit</a> <a href="https://digitalcourage.social/tags/Verschl%C3%BCsselung" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Verschlüsselung</a> <a href="https://digitalcourage.social/tags/encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#encryption</a> <a href="https://digitalcourage.social/tags/WEtell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WEtell</a> <a href="https://digitalcourage.social/tags/SoloKey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SoloKey</a> <a href="https://digitalcourage.social/tags/NitroKey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NitroKey</a> <a href="https://digitalcourage.social/tags/Email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Email</a> <a href="https://digitalcourage.social/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://digitalcourage.social/tags/Pixelfed" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pixelfed</a> <a href="https://digitalcourage.social/tags/Massen%C5%B1berwachung" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Massenűberwachung</a> <a href="https://digitalcourage.social/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> <a href="https://digitalcourage.social/tags/Metadaten" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Metadaten</a> <a href="https://digitalcourage.social/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WhatsApp</a> <a href="https://digitalcourage.social/tags/Threema" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Threema</a> <a href="https://digitalcourage.social/tags/Cryptpad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cryptpad</a> <a href="https://digitalcourage.social/tags/Signal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Signal</a> <a href="https://digitalcourage.social/tags/Hateaid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hateaid</a> <a href="https://digitalcourage.social/tags/Cyberstalking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cyberstalking</a> <a href="https://digitalcourage.social/tags/Messenger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Messenger</a> <a href="https://digitalcourage.social/tags/Browser" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Browser</a> <a href="https://digitalcourage.social/tags/Youtube" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Youtube</a> <a href="https://digitalcourage.social/tags/NewPipe" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NewPipe</a> <a href="https://digitalcourage.social/tags/Chatkontrolle" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Chatkontrolle</a> <a href="https://digitalcourage.social/tags/nichtszuverbergen" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nichtszuverbergen</a> <a href="https://digitalcourage.social/tags/%C3%9CberwachungsKapitalismus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ÜberwachungsKapitalismus</a> <a href="https://digitalcourage.social/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> <a href="https://digitalcourage.social/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://digitalcourage.social/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> <a href="https://digitalcourage.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://digitalcourage.social/tags/Matrix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Matrix</a> <a href="https://digitalcourage.social/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://digitalcourage.social/tags/Friendica" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Friendica</a> <a href="https://digitalcourage.social/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://digitalcourage.social/tags/Mastodir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodir</a> <a href="https://digitalcourage.social/tags/Loops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Loops</a> <a href="https://digitalcourage.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> <a href="https://digitalcourage.social/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ransomware</a> <a href="https://digitalcourage.social/tags/Foss" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Foss</a> <a href="https://digitalcourage.social/tags/VeraCrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VeraCrypt</a> <a href="https://digitalcourage.social/tags/HateAid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HateAid</a> <a href="https://digitalcourage.social/tags/Coreboot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Coreboot</a> <a href="https://digitalcourage.social/tags/Volksverpetzer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Volksverpetzer</a> <a href="https://digitalcourage.social/tags/Netzpolitik" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Netzpolitik</a> <a href="https://digitalcourage.social/tags/Digitalisierung" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Digitalisierung</a> <a href="https://digitalcourage.social/tags/FragdenStaat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FragdenStaat</a> <a href="https://digitalcourage.social/tags/Shiftphone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Shiftphone</a>  <a href="https://digitalcourage.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://digitalcourage.social/tags/GrapheneOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GrapheneOS</a> <a href="https://digitalcourage.social/tags/CCC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CCC</a> <a href="https://digitalcourage.social/tags/Mail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mail</a> <a href="https://digitalcourage.social/tags/Mullvad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mullvad</a> <a href="https://digitalcourage.social/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PGP</a> <a href="https://digitalcourage.social/tags/GnuPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GnuPG</a> <a href="https://digitalcourage.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://digitalcourage.social/tags/Gaming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gaming</a> <a href="https://digitalcourage.social/tags/linuxgaming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linuxgaming</a> <a href="https://digitalcourage.social/tags/Lutris" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Lutris</a> <a href="https://digitalcourage.social/tags/Protondb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Protondb</a> <a href="https://digitalcourage.social/tags/eOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#eOS</a> <a href="https://digitalcourage.social/tags/Enshittification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Enshittification</a> <a href="https://digitalcourage.social/tags/Bloatware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bloatware</a> <a href="https://digitalcourage.social/tags/TPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TPM</a> <a href="https://digitalcourage.social/tags/Murena" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Murena</a>  <a href="https://digitalcourage.social/tags/LiberaPay" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LiberaPay</a> <a href="https://digitalcourage.social/tags/GnuTaler" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GnuTaler</a> <a href="https://digitalcourage.social/tags/Taler" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Taler</a> <a href="https://digitalcourage.social/tags/PreppingforFuture" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PreppingforFuture</a> <a href="https://digitalcourage.social/tags/FediLZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FediLZ</a> <a href="https://digitalcourage.social/tags/BlueLZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BlueLZ</a> <a href="https://digitalcourage.social/tags/InstaLZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InstaLZ</a> <a href="https://digitalcourage.social/tags/ThreatModel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModel</a> <a href="https://digitalcourage.social/tags/FLOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FLOSS</a> <a href="https://digitalcourage.social/tags/UEFI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UEFI</a> <a href="https://digitalcourage.social/tags/Medienkompetenz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Medienkompetenz</a>

Paul Kater<a href="https://nlpagan.net/password-and-mfa2fa.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://nlpagan.net/password-and-mfa2fa.html</a>More on security, getting European options and such.<a href="https://social.vivaldi.net/@ueeu" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ueeu</a><a href="https://writing.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://writing.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a> <a href="https://writing.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a>

Wren :HeartQueer:Riddle me this. If I was to do an experiment where I did a landline for a month with no cellphone, how would I offload Microsoft's 2FA auth app I need for work? Can it safely be emulated on a virtual device on a Linux host?Man if there was ever a use case for iPod touch to come back. I wonder if there is a current Android equivalent? <a href="https://kind.social/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://kind.social/tags/android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#android</a> <a href="https://kind.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a>

NickI'm often disappointed by how poor the <a href="https://mathstodon.xyz/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> is on the websites of financial institutions, many still offering only SMS <a href="https://mathstodon.xyz/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> or no 2FA at all. But a small number are better and offer at TOTP or even FIDO. Does anyone actually try to track which institutions offer what? This would definitely be a factor for me in the future choices (if I could get this information).<a href="https://mathstodon.xyz/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Tommaso GagliardoniI am looking for a reliable mail hosting provider, with 2FA, unlimited aliases (including catch-all * ), POP+SMTP+IMAP, no mobile app required, with configurable domain but not bundled to the provider being the registrar. Possibly based in EU/Switzerland.Discarded options: - I am moving away from Gandi. - Infomaniak seems to require registering domain with them. - Zoho based in UK. - MXroute does not seem to offer 2FA. - Autistici/Inventati only with one of their domains (not configurable). - Fastmail based in Australia. - Mailcheap based in USA.Thankful for any suggestions 😀 <a href="https://infosec.exchange/tags/email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#email</a> <a href="https://infosec.exchange/tags/hosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hosting</a> <a href="https://infosec.exchange/tags/gandi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gandi</a> <a href="https://infosec.exchange/tags/eu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#eu</a> <a href="https://infosec.exchange/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://infosec.exchange/tags/zoho" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#zoho</a> <a href="https://infosec.exchange/tags/infomaniak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infomaniak</a> <a href="https://infosec.exchange/tags/mailcheap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mailcheap</a> <a href="https://infosec.exchange/tags/mxroute" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mxroute</a> <a href="https://infosec.exchange/tags/fastmail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fastmail</a> <a href="https://infosec.exchange/tags/AutisticiInventati" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AutisticiInventati</a>

(Des)aponta e ClicaAtualmente uso o <a href="https://mastodon.social/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> authenticator para MFA/2FA. Quero mudar para uma opção segura e <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a>. Que funcione tanto em mobile quanto no desktop ( <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> e <a href="https://mastodon.social/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> ) Sugestões?Uso o navegador <a href="https://mastodon.social/tags/floorp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#floorp</a> ( <a href="https://mastodon.social/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firefox</a> )Currently using <a href="https://mastodon.social/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> authenticator for MFA/2FA. I want to change to a secure and <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> option. It should work both on mobile and desktop ( <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> and <a href="https://mastodon.social/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> ) Suggestions?If suggestion is a browser extension I'm using <a href="https://mastodon.social/tags/floorp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#floorp</a> ( <a href="https://mastodon.social/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firefox</a> fork )<a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a> <a href="https://mastodon.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a>

scrap//code :corteximplant:I am looking for a <a href="https://corteximplant.com/tags/foss" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#foss</a> or at least <a href="https://corteximplant.com/tags/eu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#eu</a> or <a href="https://corteximplant.com/tags/efta" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#efta</a> based <a href="https://corteximplant.com/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://corteximplant.com/tags/authenticator" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authenticator</a> app that is available for <a href="https://corteximplant.com/tags/ios" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ios</a> to migrage away from the <a href="https://corteximplant.com/tags/techbro" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#techbro</a> authenticator I am currently using. My first investigation brought up 2FAS. Is this a recommended piece of software? Any alternatives? --- <a href="https://corteximplant.com/tags/unplugtrump" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unplugtrump</a>

Pierre-Yves LapersonneGood :blobcatcoffee: <a href="https://framapiaf.org/tags/iOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iOS</a> <a href="https://framapiaf.org/tags/iosdev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iosdev</a> <a href="https://framapiaf.org/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://framapiaf.org/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> <a href="https://framapiaf.org/tags/a11y" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#a11y</a> <a href="https://framapiaf.org/tags/VoiceOver" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VoiceOver</a>

JP MensA look at <a href="https://mastodon.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> hosting with <a href="https://mastodon.social/tags/deSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#deSEC</a>deSEC is free of charge to use, supports <a href="https://mastodon.social/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>, <a href="https://mastodon.social/tags/IPv6" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IPv6</a>, REST API, <a href="https://mastodon.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> with <a href="https://mastodon.social/tags/TOTP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TOTP</a> tokens, and dynDNS integration among others.<a href="https://jpmens.net/2025/03/04/a-look-at-domain-hosting-with-desec/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://jpmens.net/2025/03/04/a-look-at-domain-hosting-with-desec/</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/PayPal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PayPal</a> Security—<a href="https://mastodon.thenewoil.org/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> Codes To Be Replaced By Single-Step Login<a href="https://www.forbes.com/sites/daveywinder/2025/03/01/paypal-security-2fa-codes-to-be-replaced-by-single-step-login/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.forbes.com/sites/daveywinder/2025/03/01/paypal-security-2fa-codes-to-be-replaced-by-single-step-login/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

copy ... toOt ... paste<a href="https://social.tchncs.de/tags/LinkedIn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LinkedIn</a> so: Hier kannst du einen sicheren Login mit <a href="https://social.tchncs.de/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> einrichten.auch LinkedIn: Hier sind täglich 10 unverschlüsselt übertragene Emails, die Links enthalten, die dich direkt einloggen.Was zur Hölle?

Abimelech B. 🐧🇩🇪| wörk ™️"Für Nutzer mit aktivierter Zwei-Faktor-Authentifizierung (2FA) war CVE-2023-7028 grundsätzlich weniger problematisch, da das Passwort allein in diesem Fall für den Zugriff auf das jeweilige Konto nicht ausreicht. Dieser Umstand verdeutlicht einmal mehr, wie wichtig es ist, von derartigen Sicherheitsfunktionen Gebrauch zu machen."<a href="https://www.golem.de/news/sicherheitsluecke-per-passwort-reset-fremde-gitlab-konten-infiltriert-2503-193884.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.golem.de/news/sicherheitsluecke-per-passwort-reset-fremde-gitlab-konten-infiltriert-2503-193884.html</a><a href="https://fulda.social/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mfa</a> <a href="https://fulda.social/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://fulda.social/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> <a href="https://fulda.social/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a> <a href="https://fulda.social/tags/cve_2023_7028" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve_2023_7028</a>

Terence Eden🆕 blog! “Towards a test-suite for TOTP codes”Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam about the current TOTP spec being irresponsibly obsolete.The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA…👀 Read more: <a href="https://shkspr.mobi/blog/2025/03/towards-a-test-suite-for-totp-codes/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shkspr.mobi/blog/2025/03/towards-a-test-suite-for-totp-codes/</a> ⸻ <a href="https://mastodon.social/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/HTOP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HTOP</a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://mastodon.social/tags/totp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#totp</a>

Terence Eden’s BlogTowards a test-suite for TOTP codes<a href="https://shkspr.mobi/blog/2025/03/towards-a-test-suite-for-totp-codes/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shkspr.mobi/blog/2025/03/towards-a-test-suite-for-totp-codes/</a>Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam about the current TOTP0 spec being <a href="https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/" rel="nofollow noopener noreferrer" target="_blank">irresponsibly obsolete</a>.The three major implementations of the spec - <a href="https://github.com/google/google-authenticator/wiki/Key-Uri-Format" rel="nofollow noopener noreferrer" target="_blank">Google</a>, <a href="https://developer.apple.com/documentation/authenticationservices/securing-logins-with-icloud-keychain-verification-codes#3795996" rel="nofollow noopener noreferrer" target="_blank">Apple</a>, and <a href="https://docs.yubico.com/yesdk/users-manual/application-oath/uri-string-format.html" rel="nofollow noopener noreferrer" target="_blank">Yubico</a> - all subtly disagree on how it should be implemented. Every other MFA app has their own idiosyncratic variants. The <a href="https://datatracker.ietf.org/doc/html/rfc6238" rel="nofollow noopener noreferrer" target="_blank">official RFC is infuriatingly vague</a>. That's no good for a security specification. Multiple implementations are great, multiple interpretations are not.So I've <a href="https://edent.codeberg.page/TOTP_Test_Suite/" rel="nofollow noopener noreferrer" target="_blank">built a nascent test suite</a> - you can use it to see if your favourite app can correctly implement the TOTP standard.<a href="https://edent.codeberg.page/TOTP_Test_Suite/" rel="nofollow noopener noreferrer" target="_blank"></a>Please do contribute tests and / or feedback.Here's what the standard actually says - see if you can find apps which don't implement it correctly.BackgroundTime-based One Time Passwords are based on HOTP - HMAC-Based One-Time Password.HOTP uses counters; a new password is regularly generated. TOTP uses time as the counter. At the time of writing this post, there have been about 1,740,800,000 seconds since the UNIX Epoc. So a TOTP with an period of 30 seconds is on counter (1,740,800,000 ➗ 30) = 58,026,666. Every 30 seconds, that counter increments by one.Number of digitsHow many digits should your 2FA token have? Google says 6 or 8. YubiCo graciously allows 7. Why those limits? Who knows!?<a href="https://datatracker.ietf.org/doc/html/rfc4226#section-5.4" rel="nofollow noopener noreferrer" target="_blank">The HOTP specification gives an example of 6 digits</a>. The example generates a code of <code>0x50ef7f19</code> which, in decimal, is <code>1357872921</code>. It then takes the last 6 digits to produce the code <code>872921</code>.The TOTP RFC say:<blockquote>Basically, the output of the HMAC-SHA-1 calculation is truncated to obtain user-friendly values <a href="https://datatracker.ietf.org/doc/html/rfc6238#section-1.2" rel="nofollow noopener noreferrer" target="_blank">1.2. Background</a></blockquote>But doesn't say how far to truncate.There's nothing I can see in the spec that prevents an implementer using all 10. The HOTP spec, however, does place a minimum requirement - but no maximum:<blockquote>Implementations MUST extract a 6-digit code at a minimum and possibly 7 and 8-digit code. Depending on security requirements, Digit = 7 or more SHOULD be considered in order to extract a longer HOTP value. <a href="https://datatracker.ietf.org/doc/html/rfc4226#section-5.3" rel="nofollow noopener noreferrer" target="_blank">RFC 4226 - 5.3. Generating an HOTP Value</a></blockquote>(As a minor point, the first digit is restricted to 0-2, so being 10 digits long isn't significantly stronger than 9 digits.)Is a 4 digit code acceptable? The security might be weaker, but the usability is greater. Most apps will allow a one digit code to be returned. If no digits are specified, what should the default be?AlgorithmThe given algorithm in the HOTP spec is SHA-1.<blockquote>In order to create the HOTP value, we will use the HMAC-SHA-1 algorithm <a href="https://datatracker.ietf.org/doc/html/rfc4226#section-5.2" rel="nofollow noopener noreferrer" target="_blank">RFC 4226 - 5.2. Description</a></blockquote>As we now know, SHA-1 has some fundamental weaknesses. The spec comments (perhaps somewhat naïvely) about SHA-1:<blockquote>The new attacks on SHA-1 have no impact on the security of HMAC-SHA-1. <a href="https://datatracker.ietf.org/doc/html/rfc4226#appendix-B.2" rel="nofollow noopener noreferrer" target="_blank">RFC 4226 - B.2. HMAC-SHA-1 Status</a></blockquote>I daresay that's accurate. But the TOTP authors disagree and allow a for some different algorithms to be used. The specification for HMAC says:<blockquote>HMAC can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1 [Emphasis added] <a href="https://datatracker.ietf.org/doc/html/rfc2104" rel="nofollow noopener noreferrer" target="_blank">RFC 2104 - HMAC: Keyed-Hashing for Message Authentication</a></blockquote>So most TOTP implementation allow SHA-1, SHA-256, and SHA-512.<blockquote>TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions […] instead of the HMAC-SHA-1 function that has been specified for the HOTP computation <a href="https://datatracker.ietf.org/doc/html/rfc6238#section-1.2" rel="nofollow noopener noreferrer" target="_blank">RFC 6238 - TOTP: Time-Based One-Time Password Algorithm</a></blockquote>But the HOTP spec goes on to say:<blockquote>Current candidates for such hash functions include SHA-1, MD5, RIPEMD-128/160. These different realizations of HMAC will be denoted by HMAC-SHA1, HMAC-MD5, HMAC-RIPEMD <a href="https://datatracker.ietf.org/doc/html/rfc2104#section-1" rel="nofollow noopener noreferrer" target="_blank">RFC 2104 - Introduction</a></blockquote>So, should your TOTP app be able to handle an MD5 HMAC, or even SHA3-384? Will it? If no algorithm is specified, what should the default be?PeriodAs discussed, this is what increments the counter for HOTP. The <a href="https://github.com/google/google-authenticator/wiki/Key-Uri-Format" rel="nofollow noopener noreferrer" target="_blank">Google Spec</a> says:<blockquote>The period parameter defines a period that a TOTP code will be valid for, in seconds. The default value is 30.</blockquote>The TOTP RFC says:<blockquote>We RECOMMEND a default time-step size of 30 seconds <a href="https://datatracker.ietf.org/doc/html/rfc6238#section-5.2" rel="nofollow noopener noreferrer" target="_blank">5.2. Validation and Time-Step Size</a></blockquote>It doesn't make sense to have a negative number of second. But what about one second? What about a thousand? Lots of apps artificially restrict TOTP codes to 15, 30, or 60 seconds. But there's no specification to define a maximum or minimum value.A user with mobility difficulties or on a high-latency connection probably wants a 5 minute validity period. Conversely, machine-to-machine communication can probably be done with a single-second (or lower) time period.SecretGoogle says the secret is<blockquote>an arbitrary key value encoded in Base32 according to RFC 3548. The padding specified in RFC 3548 section 2.2 is not required and should be omitted.</blockquote>Whereas Apple says it is:<blockquote>An arbitrary key value encoded in Base32. Secrets should be at least 160 bits.</blockquote>Can a shared secret be a single character? What about a thousand? Will padding characters cause a secret to be rejected or can they be safely stripped?LabelThe label allows you to have multiple codes for the same service. For example <code>Big Bank:Personal Account</code> and <code>Big Bank:Family Savings</code>. The Google spec is slightly confusing:<blockquote>The issuer prefix and account name should be separated by a literal or url-encoded colon, and optional spaces may precede the account name. Neither issuer nor account name may themselves contain a colon.</blockquote>What happens if they are not URl encoded? What about Matrix accounts which use a colon in their account name? Why are spaces allowed to precede the account name? Is there any practical limit to the length of these strings?If no label is specified, what should the default be?IssuerGoogle says this parameter is:<blockquote>Strongly Recommended The issuer parameter is a string value indicating the provider or service this account is associated with, URL-encoded according to RFC 3986. If the issuer parameter is absent, issuer information may be taken from the issuer prefix of the label. If both issuer parameter and issuer label prefix are present, they should be equal.</blockquote>Apple merely says:<blockquote>The domain of the site or app. The password manager uses this field to suggest credentials when setting up a new code generator.</blockquote>Yubico equivocates with<blockquote>The issuer parameter is recommended, but it can be absent. Also, the issuer parameter and issuer string in label should be equal.</blockquote>If it isn't a domain, will Apple reject it? What happens if the issuer and the label don't match?Next Steps<ul><li>If you're a user, <a href="https://codeberg.org/edent/TOTP_Test_Suite" rel="nofollow noopener noreferrer" target="_blank">please contribute tests</a> or give feedback.</li><li>If you're a developer, please check your app conforms to the specification.</li><li>If you're from Google, Apple, Yubico, or another security company - wanna help me write up a proper RFC so this doesn't cause issues in the future?</li></ul> <ol start="0"><li>Time-based One Time Passwords. Not the TV show you remember from your youth, grandad. ↩︎</li></ol> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/2fa/" target="_blank">#2fa</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/cybersecurity/" target="_blank">#CyberSecurity</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/htop/" target="_blank">#HTOP</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/mfa/" target="_blank">#MFA</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/open-source/" target="_blank">#OpenSource</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/totp/" target="_blank">#totp</a>

teufelswerkZapier (NoCode-Software) informierte am Freitag Kunden darüber, dass ein Unbefugter Zugriff auf Code-Repositories u. Kundendaten erhalten habe. Der Unbefugte konnte aufgrund einer Fehlkonfiguration der Zwei-Faktor-Authentifizierung (2FA) im Konto eines Mitarbeiters auf die Repositories zugreifen. Die Repositories hätten aber keine Kundendaten enthalten dürfen. Diese wurden versehentlich von Zapier hineinkopiert...<a href="https://www.theverge.com/news/622026/zapier-data-breach-code-repositories" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.theverge.com/news/622026/zapier-data-breach-code-repositories</a><a href="https://social.tchncs.de/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://social.tchncs.de/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mfa</a> <a href="https://social.tchncs.de/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://social.tchncs.de/tags/leak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#leak</a> <a href="https://social.tchncs.de/tags/misconfiguration" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#misconfiguration</a> <a href="https://social.tchncs.de/tags/zapier" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#zapier</a>

julian2FA codes sent over ActivityPub when?

TutaThe <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://mastodon.social/tags/Trinity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Trinity</a> - spotted at <a href="https://fosstodon.org/@bitwarden" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bitwarden</a> explains how to secure your accounts with 2FA:👉 <a href="https://bitwarden.com/resources/presentations/the-triangle-of-security-success/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://bitwarden.com/resources/presentations/the-triangle-of-security-success/</a>And rightly so: Because <a href="https://mastodon.social/tags/encrypted" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#encrypted</a> email get even more secure with <a href="https://mastodon.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> and <a href="https://mastodon.social/tags/passwordmanagers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#passwordmanagers</a> 💪Check out our top 3: <a href="https://tuta.com/blog/best-password-manager" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://tuta.com/blog/best-password-manager</a>

Korrespondent zur SeeWas ich lese: "… senden wir alle Ihre <a href="https://mastodon.social/tags/SMS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SMS</a>-Nachrichten an ein [vermutlich US-basiertes] AI-Unternehmen." - In 2025 sind das bei mir 50/50 Spam und Bestätigungscodes. Wahlweise erhalten damit <a href="https://mastodon.social/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a>, <a href="https://mastodon.social/tags/Facebook" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Facebook</a>, [$AiTechBude] umfangreiche Listen von Diensten, bei denen ich SMS für <a href="https://mastodon.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> nutze (inkl. Absendernummern und meine Empfängernummer) und mit der Drohung, an mich gerichtete SMS zu blockieren. – Hat vielleicht jemand aus der <a href="https://mastodon.social/tags/netzpol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#netzpol</a> Szene Infos? (<a href="https://23.social/@linuzifer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@linuzifer</a> ?) <a href="https://mastodon.social/tags/privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#privacy</a> <a href="https://mastodon.social/tags/KI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KI</a> <a href="https://mastodon.social/tags/Datenschutz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Datenschutz</a>

Tarnkappe.info📬 mailbox.org 2FA im Fokus: Wann wird es endlich so bequem wie sicher? <a href="https://social.tchncs.de/tags/Datenschutz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Datenschutz</a> <a href="https://social.tchncs.de/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> <a href="https://social.tchncs.de/tags/Mailboxorg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mailboxorg</a> <a href="https://social.tchncs.de/tags/mailboxorg2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mailboxorg2fa</a> <a href="https://social.tchncs.de/tags/Mailboxorg2FAaktivieren" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mailboxorg2FAaktivieren</a> <a href="https://social.tchncs.de/tags/mailboxorgZweiFaktorSchutz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mailboxorgZweiFaktorSchutz</a> <a href="https://social.tchncs.de/tags/Problememit2FAbeiMailboxorg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Problememit2FAbeiMailboxorg</a> <a href="https://sc.tarnkappe.info/bb0bf5" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://sc.tarnkappe.info/bb0bf5</a>

Frühere Suchanfragen

Suchoptionen

Verwaltet von:

Serverstatistik: