#accountlockout — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #accountlockout, aggregated by home.social.
-
@jtb : an increasing number of people I know do no longer use desktops (that is, at home). An iPhone and an iPad, or an Android phone (and optionally a Chromebook), suffice for most people.
Commercial password managers will try to lock you in as a customer, while using open source (such as KeePass compatible) apps leads to other risks (such as stopped maintenance or malicious take over).
Most people I know even refuse to use password managers because of their complexity - while they enormously underestimate their risks by using one or a few weak passwords written on paper or stored in excel sheets.
Some of them feel betrayed after being advised to use TOTP 2FA - which is not phishing resistant, effectively *is* a password manager, too often without backups (of the shared secrets) being made, leading to account lockout after losing their phones (or app malfunction). And I'm not even considering privacy invasive and insecure TOTP apps such as Authy.
Nobody warned them of risks associated with TOTP, as nobody warns them for the risks that come with passkeys. People are, IMO, righfully not interested in the crap the industry is trying to enforce on them.
-
@jtb : an increasing number of people I know do no longer use desktops (that is, at home). An iPhone and an iPad, or an Android phone (and optionally a Chromebook), suffice for most people.
Commercial password managers will try to lock you in as a customer, while using open source (such as KeePass compatible) apps leads to other risks (such as stopped maintenance or malicious take over).
Most people I know even refuse to use password managers because of their complexity - while they enormously underestimate their risks by using one or a few weak passwords written on paper or stored in excel sheets.
Some of them feel betrayed after being advised to use TOTP 2FA - which is not phishing resistant, effectively *is* a password manager, too often without backups (of the shared secrets) being made, leading to account lockout after losing their phones (or app malfunction). And I'm not even considering privacy invasive and insecure TOTP apps such as Authy.
Nobody warned them of risks associated with TOTP, as nobody warns them for the risks that come with passkeys. People are, IMO, righfully not interested in the crap the industry is trying to enforce on them.
-
@jtb : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most.
Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks?
Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies.
Screenshots, chronological:
1) Top right: contents of Google Password Manager after creating a passkey on https://webauthn.io
2) Left: tapping the "Delete data" button in https://chrome.google.com/sync
3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in https://chrome.google.com/sync. The passkey is gone.
People are wrongly made to believe that Google passkeys are stored safely on their device; they are not.
-
@jtb : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most.
Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks?
Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies.
Screenshots, chronological:
1) Top right: contents of Google Password Manager after creating a passkey on https://webauthn.io
2) Left: tapping the "Delete data" button in https://chrome.google.com/sync
3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in https://chrome.google.com/sync. The passkey is gone.
People are wrongly made to believe that Google passkeys are stored safely on their device; they are not.
-
Facebook’s account system is absurdly permanent. Delete an account and you’re locked out for good — can’t reuse your email, can’t start fresh, no appeal, no second chance. Even username‑based platforms handle identity better. Facebook’s “account integrity” model traps real users instead of helping them.
-
Facebook’s account system is absurdly permanent. Delete an account and you’re locked out for good — can’t reuse your email, can’t start fresh, no appeal, no second chance. Even username‑based platforms handle identity better. Facebook’s “account integrity” model traps real users instead of helping them.
-
Smart Home Diagnostic (Lukas): Maytag
Maytag Account Lockout Fix: Troubleshooting Guide
#Maytag #Unknown #AccountLockout
🔍 Full Report: https://www.digitalhomefaults.org/maytag/unknown/maytag-account-lockout-fix
-
@chazh : I never said "passkeys are bull shit" (see https://todon.nl/@ErikvanStraten/115656347170869180).
🚨 Android, unfixed: https://seclists.org/fulldisclosure/2024/Feb/15
🚨 iOS/iPadOS (including 26.x): either
• if no fingerprint is configured
OR
• a fingerprint is configured but, under "Setting"s ➡️ "Touch ID & Passcode": "Password Autofill" is offthen a thief of my iDevice can logon to https://account.apple.com and https://icloud.com using my Apple passkey *without* scanning ANY finger or entering ANY screen unlock code.
Apple: "This is expected behavior".
-
@chazh : I never said "passkeys are bull shit" (see https://todon.nl/@ErikvanStraten/115656347170869180).
🚨 Android, unfixed: https://seclists.org/fulldisclosure/2024/Feb/15
🚨 iOS/iPadOS (including 26.x): either
• if no fingerprint is configured
OR
• a fingerprint is configured but, under "Setting"s ➡️ "Touch ID & Passcode": "Password Autofill" is offthen a thief of my iDevice can logon to https://account.apple.com and https://icloud.com using my Apple passkey *without* scanning ANY finger or entering ANY screen unlock code.
Apple: "This is expected behavior".
-
@soatok : this is *NOT* what makes passkeys resistant to most phishing attacks.
Don't get fooled by the snake oil regarding asymmetric cryptography.
What makes passkeys strong:
1️⃣ The *main* domain name must match
2️⃣ https is mandatory
3️⃣ The length and randomness of the pubkey in most cases exceeds what is permitted for a password
4️⃣ The pubkey is unique per accountWhat makes passkeys weak:
1️⃣ They do not prevent session cookie (1FA) theft
2️⃣ Android and iOS/iPadOS passkeys are extremely hard to back up outside of their ecosystems (vendor lock-in)
3️⃣ An attacker with access to your account may ADD their own passkey (it's pubkey) or REPLACE yours
4️⃣ Implementation bugs: Android passkeys easily lost and iOS/iPadOS passkeys may be used without local authentication
5️⃣ Misinformation by people who THINK that they understand how passkeys, WebAuthn and FIDO2 work
6️⃣ (edited to add 15:40 UTC): weak https website certificates (passkeys could mitigate this risk by including the https cert or a reliable hash of it - provided that the RP checks it. Unfortunately this will break "legitimate" TLS MitM's). -
@soatok : this is *NOT* what makes passkeys resistant to most phishing attacks.
Don't get fooled by the snake oil regarding asymmetric cryptography.
What makes passkeys strong:
1️⃣ The *main* domain name must match
2️⃣ https is mandatory
3️⃣ The length and randomness of the pubkey in most cases exceeds what is permitted for a password
4️⃣ The pubkey is unique per accountWhat makes passkeys weak:
1️⃣ They do not prevent session cookie (1FA) theft
2️⃣ Android and iOS/iPadOS passkeys are extremely hard to back up outside of their ecosystems (vendor lock-in)
3️⃣ An attacker with access to your account may ADD their own passkey (it's pubkey) or REPLACE yours
4️⃣ Implementation bugs: Android passkeys easily lost and iOS/iPadOS passkeys may be used without local authentication
5️⃣ Misinformation by people who THINK that they understand how passkeys, WebAuthn and FIDO2 work
6️⃣ (edited to add 15:40 UTC): weak https website certificates (passkeys could mitigate this risk by including the https cert or a reliable hash of it - provided that the RP checks it. Unfortunately this will break "legitimate" TLS MitM's). -
Zwakke 2FA/MFA werkt AVERECHTS
In https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912477 schreef ik eerder deze week:
❝
2FA (MFA) is ruk.Laat de overheid een wachtwoordmanager adviseren die wél op domeinnamen checkt.
❞
(Dat laatste kan standaard onder Android, iOS en iPadOS - middels "AutoFill").Op veler "verzoek" onderbouwde ik die stelling (niet voor de eerste keer) in https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912530.
En in https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912733 legde ik uit waarom online inloggen *lastig* veilig te krijgen is - wat je ook verzint (het blijven shared secrets).
Vandaag heb ik Microsoft Authenticator ook maar weer eens getest (onder Android). Mijn bevindingen leest u in (de tweede helft van) https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912864 - hieronder een stukje daaruit.
#ZwakkeMFA #SMS #AuthenticatorApps #Zwakke2FA #Weak2FA #WeakMFA #MicrosoftAuthenticator #2FAsucks #MFAsucks #Phishing #NepWebsites #PhaaS #Evilginx2 #SIMswap #SS7 #AcountTakeOver #CookieTheft #AccountLockout
-
Fired Disney worker accused of hacking into restaurant menus, replacing them with Windings and false peanut allergy information – Source: www.bitdefender.com https://ciso2ciso.com/fired-disney-worker-accused-of-hacking-into-restaurant-menus-replacing-them-with-windings-and-false-peanut-allergy-information-source-www-bitdefender-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DenialofService #grahamcluleycom #accountlockout #Grahamcluley #Guestblog #Lawℴ #Disney
-
Fired Disney worker accused of hacking into restaurant menus, replacing them with Windings and false peanut allergy information – Source: www.bitdefender.com https://ciso2ciso.com/fired-disney-worker-accused-of-hacking-into-restaurant-menus-replacing-them-with-windings-and-false-peanut-allergy-information-source-www-bitdefender-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DenialofService #grahamcluleycom #accountlockout #Grahamcluley #Guestblog #Lawℴ #Disney
-
Fired Disney worker accused of hacking into restaurant menus, replacing them with Windings and false peanut allergy information https://www.bitdefender.com/en-us/blog/hotforsecurity/fired-disney-worker-hacking-restaurant-menus-replacing-false-peanut-allergy/ #DenialofService #accountlockout #Guestblog #Lawℴ #Disney
-
Fired Disney worker accused of hacking into restaurant menus, replacing them with Windings and false peanut allergy information https://www.bitdefender.com/en-us/blog/hotforsecurity/fired-disney-worker-hacking-restaurant-menus-replacing-false-peanut-allergy/ #DenialofService #accountlockout #Guestblog #Lawℴ #Disney
-
Want to ban someone from Instagram? That’ll cost you just $60 https://www.tripwire.com/state-of-security/security-data-protection/want-ban-someone-instagram/ #accountsuspension #accountlockout #Guestblog #Instagram #Privacy