#2fa — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #2fa, aggregated by home.social.
-
This #Yubico #YubiKey Standard from approximately 2012 was on my personal key ring ever since on a daily basis. It has been my first FIDO2 token.
It now ceased to work after approx. 14 years as it's no longer recognized by a computer when plugged in.
Fortunately, it's been mostly replaced by a newer key months ago. So no data loss. Furthermore, I always had a second token that was registered with the same services anyway.
That's my personal data point for durability of #FIDO2 #security hardware tokens. Not bad, I'd say. 👍️
I still prefer FIDO2 HW tokens over #passkeys because HW tokens are not prone to #phishing: https://karl-voit.at/FIDO2-vs-Passkeys/ (German)
#2FA #MFA #securitytokens #publicvoit #20241005_FIDO2VsPasskeys
-
This #Yubico #YubiKey Standard from approximately 2012 was on my personal key ring ever since on a daily basis. It has been my first FIDO2 token.
It now ceased to work after approx. 14 years as it's no longer recognized by a computer when plugged in.
Fortunately, it's been mostly replaced by a newer key months ago. So no data loss. Furthermore, I always had a second token that was registered with the same services anyway.
That's my personal data point for durability of #FIDO2 #security hardware tokens. Not bad, I'd say. 👍️
I still prefer FIDO2 HW tokens over #passkeys because HW tokens are not prone to #phishing: https://karl-voit.at/FIDO2-vs-Passkeys/ (German)
#2FA #MFA #securitytokens #publicvoit #20241005_FIDO2VsPasskeys
-
Webanalyse: #Umami führt Zwei-Faktor-Login ein | iX Magazin https://www.heise.de/news/Webanalyse-Umami-fuehrt-Zwei-Faktor-Login-ein-11413016.html #GoogleAnalytics #WebAnalysis #Datenschutz #privacy #OpenSource #DigitalSovereignty #Tracking #2FA #2FactorAuthentication
-
Webanalyse: #Umami führt Zwei-Faktor-Login ein | iX Magazin https://www.heise.de/news/Webanalyse-Umami-fuehrt-Zwei-Faktor-Login-ein-11413016.html #GoogleAnalytics #WebAnalysis #Datenschutz #privacy #OpenSource #DigitalSovereignty #Tracking #2FA #2FactorAuthentication
-
Tried to configure proper #2FA on my company's service provider site, as it's set to SMS as default. Found just one button to "configure authenticator app". It displays #QRcode without any code to manually copy.
Not good, my preferred interface for #YubicoAuthenticator is cli, because I want to properly set touch and touch in it currently works weirdly in phone app.So my nerdy ass scanned that code using generic barcode scanner on phone, copied revealed URL containing secret, pasted it to Markor file which was later copied via #Syncthing to my work laptop :blobCat_giggle:
I just cannot use things as intended...
-
Tried to configure proper #2FA on my company's service provider site, as it's set to SMS as default. Found just one button to "configure authenticator app". It displays #QRcode without any code to manually copy.
Not good, my preferred interface for #YubicoAuthenticator is cli, because I want to properly set touch and touch in it currently works weirdly in phone app.So my nerdy ass scanned that code using generic barcode scanner on phone, copied revealed URL containing secret, pasted it to Markor file which was later copied via #Syncthing to my work laptop :blobCat_giggle:
I just cannot use things as intended...
-
Your phone number is basically an ID card. 2FA logins tie it straight to your carrier identity — hand it out once and it's a public lookup back to you.
Rob Braxman breaks it into 3 privacy levels: 1) virtual number + forwarding, 2) full SIP app for a second line, 3) full isolation — no traditional number, data-only SIM.
Note: the principle applies with any VoIP provider or data-only SIM, not just the one he demos.
-
Your phone number is basically an ID card. 2FA logins tie it straight to your carrier identity — hand it out once and it's a public lookup back to you.
Rob Braxman breaks it into 3 privacy levels: 1) virtual number + forwarding, 2) full SIP app for a second line, 3) full isolation — no traditional number, data-only SIM.
Note: the principle applies with any VoIP provider or data-only SIM, not just the one he demos.
-
This is the part of 2FA/TOTP that many people don’t realize:
Your phone isn’t receiving the 6-digit code from the server.
Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐
It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.
At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.
Same secret + same time counter + same algorithm = same result.
That’s why your authenticator app can generate the correct code without receiving it from the server.
It’s a simple idea, but a brilliant application of cryptography.
You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.
And here’s another important point:
The algorithm doesn’t need to be secret.
TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.
So:
🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.
#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch
-
This is the part of 2FA/TOTP that many people don’t realize:
Your phone isn’t receiving the 6-digit code from the server.
Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐
It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code.
At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter.
Same secret + same time counter + same algorithm = same result.
That’s why your authenticator app can generate the correct code without receiving it from the server.
It’s a simple idea, but a brilliant application of cryptography.
You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time.
And here’s another important point:
The algorithm doesn’t need to be secret.
TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key.
So:
🧮 Algorithm/math: Can be publicly known.
🔑 Secret key: Must remain private. Never share it.
⏱️ Time: Isn’t secret.
🔐 Security: Comes from protecting the secret key, not from hiding the algorithm.That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key.
#2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch
-
Ente Auth: la #sicurezza #2FA diventa finalmente moderna e trasparente
#opensource #ios #android @sicurezza @tecnologiahttps://webappsmagazine.blogspot.com/2026/08/ente-auth-la-sicurezza-2fa-diventa.html
-
Ente Auth: la #sicurezza #2FA diventa finalmente moderna e trasparente
#opensource #ios #android @sicurezza @tecnologiahttps://webappsmagazine.blogspot.com/2026/08/ente-auth-la-sicurezza-2fa-diventa.html
-
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Indicators extracted from public reporting. Source: https://mastodon.social/share?text=The%20Permanent%20Threat:%20Analyzing%20Aeternum’s%20Blockchain-Based%20C2%20Operations%20and%20Communications%20https%3A%2F%2Funit42.paloaltonetworks.com%2Faeternum-blockchain-c2-analysis%2F
Pulse ID: 6a7a570d454dd1ca4a1449b2
Pulse Link: https://otx.alienvault.com/pulse/6a7a570d454dd1ca4a1449b2
Pulse Author: CyberHunter_NL
Created: 2026-08-10 22:56:13Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#2FA #BlockChain #CyberSecurity #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #bot #CyberHunter_NL
-
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Indicators extracted from public reporting. Source: https://mastodon.social/share?text=The%20Permanent%20Threat:%20Analyzing%20Aeternum’s%20Blockchain-Based%20C2%20Operations%20and%20Communications%20https%3A%2F%2Funit42.paloaltonetworks.com%2Faeternum-blockchain-c2-analysis%2F
Pulse ID: 6a7a570d454dd1ca4a1449b2
Pulse Link: https://otx.alienvault.com/pulse/6a7a570d454dd1ca4a1449b2
Pulse Author: CyberHunter_NL
Created: 2026-08-10 22:56:13Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#2FA #BlockChain #CyberSecurity #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #bot #CyberHunter_NL
-
I’m looking for a good alternative to Google Authenticator for Two Factor Authentication.
What authenticator app are you using, and would you recommend it? And why would you recomend it?
I have not experienced any errors and its really working fine. I am just trying to stay away from #Google Services as much as posible
-
I’m looking for a good alternative to Google Authenticator for Two Factor Authentication.
What authenticator app are you using, and would you recommend it? And why would you recomend it?
I have not experienced any errors and its really working fine. I am just trying to stay away from #Google Services as much as posible
-
#itsec fedifriends, I'd like your opinion please: is using #Passkey a good idea, compared to strong generated passwords with #2fa ?
Providers, #bigtech in particular, seem to push hard in that direction. I wonder if it is a good idea.
In my case, I use a #passwordmanager and refuse to use biometrics.
Thanks for your #fedihelp 😁
-
#itsec fedifriends, I'd like your opinion please: is using #Passkey a good idea, compared to strong generated passwords with #2fa ?
Providers, #bigtech in particular, seem to push hard in that direction. I wonder if it is a good idea.
In my case, I use a #passwordmanager and refuse to use biometrics.
Thanks for your #fedihelp 😁
-
-
-
Kunden-Anfrage kurz vorm Wochenende: wo denn 2FA für das IMAP/SMTP-Postfach eingerichtet werden kann.
Sehr gute Motivation. Da reicht es aber nicht, das RoundCube-Plugin dafür zu aktivieren.
... das wird also ein richtiger Spaß.
Sind IMAP/SMTP "durch"? 2FA können wir damit meines Erachtens doch nicht realisieren.
Oder bleibt nur noch JMAP, eine eigene App, und/oder OAuth-APIs?
#2fa #auth -
Kunden-Anfrage kurz vorm Wochenende: wo denn 2FA für das IMAP/SMTP-Postfach eingerichtet werden kann.
Sehr gute Motivation. Da reicht es aber nicht, das RoundCube-Plugin dafür zu aktivieren.
... das wird also ein richtiger Spaß.
Sind IMAP/SMTP "durch"? 2FA können wir damit meines Erachtens doch nicht realisieren.
Oder bleibt nur noch JMAP, eine eigene App, und/oder OAuth-APIs?
#2fa #auth -
Ooh, I had a client vulnerable to this one. miniOrange. New to me but popular.
-
Ooh, I had a client vulnerable to this one. miniOrange. New to me but popular.
-
I noticed that signing in to Mastodon using 2FA didn't reliably work. Turns out my system clock was ~30 seconds behind that of the actual time (currently GMT +1 for me).
On Linux distributions that have systemd, systemd apparently synchronises your system time with a time server automatically. However, I use Devuan (i.e. Debian but without systemd) so I had to do it manually.
I used `htpdate` to set the time to a UK time server on pool.ntp.org like this:
```
sudo htpdate uk.pool.ntp.org
```
No need to reboot.
It's now accurate to GMT+1 to within about half a second. :) -
I noticed that signing in to Mastodon using 2FA didn't reliably work. Turns out my system clock was ~30 seconds behind that of the actual time (currently GMT +1 for me).
On Linux distributions that have systemd, systemd apparently synchronises your system time with a time server automatically. However, I use Devuan (i.e. Debian but without systemd) so I had to do it manually.
I used `htpdate` to set the time to a UK time server on pool.ntp.org like this:
```
sudo htpdate uk.pool.ntp.org
```
No need to reboot.
It's now accurate to GMT+1 to within about half a second. :) -
Würdet Ihr #2FA als Pflicht machen für eine Plattform für einen Software wo man seine Mitgliederdaten verwaltet oder würdet Ihr magiclinks verwenden ausschließlich? ( Ich kenne die Risiken)
Hintergrund der Frage: Wir haben ein Nutzerspektrum von 18 bis 72 aktuell. Wir haben Anwender die mit PC und Login umgehen können und wir haben viele für die es eine gewaltige Herausforderung ist ein Formular auszufüllen
-
9to5 Google: Google Password Manager passkeys could be at risk with new ‘Pass-ta-key’ attack. “Passkeys are becoming more popular as a safer alternative to traditional passwords, but some cracks are starting to show after one group successfully bypassed Google’s Chrome-based passkeys using what they call the “Pass-ta-key” attack method.”
https://rbfirehose.com/2026/08/05/9to5-google-google-password-manager-passkeys-could-be-at-risk-with-new-pass-ta-key-attack/ -
9to5 Google: Google Password Manager passkeys could be at risk with new ‘Pass-ta-key’ attack. “Passkeys are becoming more popular as a safer alternative to traditional passwords, but some cracks are starting to show after one group successfully bypassed Google’s Chrome-based passkeys using what they call the “Pass-ta-key” attack method.”
https://rbfirehose.com/2026/08/05/9to5-google-google-password-manager-passkeys-could-be-at-risk-with-new-pass-ta-key-attack/ -
PSA: GitHub requires two-factor auth if you contribute code — publishing a package or Action, cutting a release, owning an org. It's been rolling out since 2023 and keeps widening; the npm rules tightened again this month.
Not set up? An authenticator app or a passkey both work. SMS works but it's the weakest option. GitHub is also moving npm publishing off TOTP toward passkeys and security keys.
Just thought I'd let y'all know.
#GitHub #2FA #TwoFactorAuthentication #Security #InfoSec #OpenSource #npm
-
PSA: GitHub requires two-factor auth if you contribute code — publishing a package or Action, cutting a release, owning an org. It's been rolling out since 2023 and keeps widening; the npm rules tightened again this month.
Not set up? An authenticator app or a passkey both work. SMS works but it's the weakest option. GitHub is also moving npm publishing off TOTP toward passkeys and security keys.
Just thought I'd let y'all know.
#GitHub #2FA #TwoFactorAuthentication #Security #InfoSec #OpenSource #npm
-
If You Want To Outwit Facebook, Do This
The workaround to keep Facebook from connecting all your dots
medium.com/@nshooter11/...
#2FA #Facebook #AI #Workaround
If You Want To Outwit Facebook... -
If You Want To Outwit Facebook, Do This
The workaround to keep Facebook from connecting all your dots
medium.com/@nshooter11/...
#2FA #Facebook #AI #Workaround
If You Want To Outwit Facebook... -
Как мы проектировали архитектуру сервиса MFA для миллиона пользователей
Система многофакторной аутентификации находится на критическом участке корпоративной инфраструктуры. Через нее проходят практически все сценарии доступа пользователей: подключение к VPN, вход в виртуальные рабочие столы, корпоративную почту, внутренние веб-приложения, облачные сервисы и административные панели. Если сервис аутентификации становится недоступным, сотрудники не могут начать работу независимо от того, насколько исправно функционируют остальные информационные системы. Поэтому выбор между облачной и локальной моделью эксплуатации в первую очередь определяется не экономикой проекта, а требованиями к доступности, отказоустойчивости, безопасности и соответствию требованиям регуляторов. За последние несколько лет мы реализовали обе модели. MULTIFACTOR используется как классическое on-premise решение внутри инфраструктуры заказчиков и одновременно существует как облачный сервис, который ежедневно обслуживает более миллиона пользователей. За это время стало очевидно, что вопрос «облако или коробка» уже не отражает реальную картину. Гораздо важнее понять, какие требования предъявляются к системе и каким образом должна быть построена ее архитектура.
https://habr.com/ru/companies/multifactor/articles/1065250/
#инфраструктура #архитектура #информационная_безопасность #2fa #mfa #multifactor #мультифактор #мультифакторная_аутентификация #двухфакторная_аутентификация
-
« Le meilleur mot de passe, c’est celui que tu n’as jamais à taper. » (Passkeys expliquées simplement) #Sécurité #2FA https://thomasbnt.dev/blog/passkeys-expliquees-simplement/
-
hot take
i fucking HATE multi-factor authentication
it has never done anything except cause me trouble
especially when i accidentally factory reset my phone
it's bullshit. fuck it
-
Die neue #TOTP Funktion in #ruccuDB 0.0.3 wirkt für eine Daten Engine auf den ersten Blick vielleicht ungewöhnlich.
Gerade darin liegt aber ihr Vorteil: TOTP Secrets werden nahtlos in der Engine verwaltet und verschlüsselt gespeichert. Anwendungen, Plugins oder andere Konsumenten können dadurch ohne eigene Kryptografie eine #2fa Lösung auf Basis von RuccuDB in PHP integrieren.
-
CVE-2025-0679 named them. NVD and MITRE still can't agree on whether you had a fighting chance. You did not.
Update your Zimbra webmail client to the patched version immediately, or TA488 keeps the loot.
Reward: You've received a hollow Authenticator Token — pre-drained.
#ZeroDay #Zimbra #Espionage #CyberSecurity #2FA #AchievementUnlocked (2/2)
-
CVE-2025-0679 named them. NVD and MITRE still can't agree on whether you had a fighting chance. You did not.
Update your Zimbra webmail client to the patched version immediately, or TA488 keeps the loot.
Reward: You've received a hollow Authenticator Token — pre-drained.
#ZeroDay #Zimbra #Espionage #CyberSecurity #2FA #AchievementUnlocked (2/2)
-
Také už vás a vaše zákazníky nebaví opisovat kódy do 2fa/mfa aplikací?
Máme pro vás rešení - 2fa aplikace s podporou PUSH notifikací, jednoduše kliknete a je hotovo!Více na https://2fa.adminit.cz
-
Také už vás a vaše zákazníky nebaví opisovat kódy do 2fa/mfa aplikací?
Máme pro vás rešení - 2fa aplikace s podporou PUSH notifikací, jednoduše kliknete a je hotovo!Více na https://2fa.adminit.cz
-
Global Webmail Espionage
A persistent cyberespionage campaign tracked as CL-STA-1114, overlapping with Russian threat actor activity known as Void Blizzard and LAUNDRY BEAR, has been targeting Zimbra webmail in government, defense, transportation, and financial organizations. The campaign focuses on NATO member states, Ukraine, Commonwealth of Independent States countries, and Africa. Attackers exploit CVE-2025-66376, a vulnerability in Zimbra Collaboration Suite, using zero-click phishing emails that automatically inject malicious JavaScript payloads without user interaction. The payload exfiltrates sensitive data including login credentials, email archives, CSRF tokens, 2FA scratch codes, and 90 days of email history to command and control servers. Active since 2024, the campaign targeting Zimbra servers began in July 2025, utilizing HTML attachments with obfuscated Base64-encoded scripts that deploy SVG elements to inject the JavaScript into victims' browsers.
Pulse ID: 6a624073df6738006a6f6e5a
Pulse Link: https://otx.alienvault.com/pulse/6a624073df6738006a6f6e5a
Pulse Author: AlienVault
Created: 2026-07-23 16:25:23Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#2FA #Africa #Browser #CyberSecurity #Cyberespionage #Email #Espionage #Government #HTML #InfoSec #Java #JavaScript #NATO #OTX #OpenThreatExchange #Phishing #RAT #Russia #SVG #UK #Ukr #Ukraine #Vulnerability #Webmail #Zimbra #bot #AlienVault
-
Email threat landscape: Q2 2026 trends and insights
During Q2 2026, Microsoft detected approximately 7.6 billion email-based phishing threats, with monthly volumes declining from 2.7 billion in April to 2.4 billion in June. The quarter was significantly shaped by the downstream effects of Microsoft's Digital Crimes Unit disruption of the Tycoon2FA phishing-as-a-service platform in March, resulting in a 92% decline in associated phishing volume. QR code phishing attacks peaked at 18.7 monthly attacks in March before declining 48% by June, while CAPTCHA-gated phishing fell 81% from its March high. Credential phishing remained the dominant objective, accounting for 94-96% of all payload-based attacks. Business email compromise activity returned to historical norms after an anomalous April surge. Microsoft Teams-based threats grew substantially, with weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by quarter end.
Pulse ID: 6a6241aa79fc3235d84045f9
Pulse Link: https://otx.alienvault.com/pulse/6a6241aa79fc3235d84045f9
Pulse Author: AlienVault
Created: 2026-07-23 16:30:34Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#2FA #CAPTCHA #CyberSecurity #Email #InfoSec #Microsoft #MicrosoftTeams #OTX #OpenThreatExchange #Phishing #bot #AlienVault
-
Two-factor authentication: AmiAuth 1.0 for AmigaOS 2.x/3.x
AmiAuth is a native 2FA tool for AmigaOS 2.0 and above. It implements TOTP (RFC 6238) and HOTP (RFC 4226) – the codes used by GitHub, Google, Microsoft, banks and countless other services – replacing a smartphone authenticator app.
