#2fa

[specialagentartemis]

I wish I could turn off mandatory 2fa. I wish it gave me a pop-up that said “Not using 2fa is less secure and puts your account at risk. Are you sure you want to do that?” and I could click “yes” and never have to enter a fucking code from a text ever again

[not-a-choice]

Saw a stupid post that I'm not going to reblog but y'all get to hear about this now:

Yes multi factor authentication is annoying. Yes it is frequently inequitable. HOWEVER. The solution is NOT "we should get rid of MFA". That is how you get hacked. That is how your grandparents (or frankly YOU) lose their life savings to one sketchy link.

There are many ways we should improve MFA. The "text me a code" option should NEVER be the only option (it's inequitable + less secure) and tech companies should be forced (taxed) to hand out yubikeys for free at the public library or smth.

I get it. Everything is getting worse and this seems like just another shitty thing tech companies are forcing on you. But MFA is not enshittification. It is ESSENTIAL cybersecurity. It needs to be made accessible to everyone because it is increasingly the only way to keep your identity and money secure.

It's also worth considering that the people who have difficulties using MFA (limited tech knowledge, no access to a cell phone, etc) are often the ones MOST at risk having their life blown up by a phishing attack. The solution here is not to make their accounts less secure.

[redflagacademy]

I’m only posting this because someone might see it and panic.

Amazon was not hacked*. She was hacked. Most likely she inadvertently got phished (sent an official-looking email or text with a link designed to get you to enter your login information on a fraudulent site).

Amazon rarely sends emails out that require immediate action. Don’t click any weird links.

Use your browser’s random password generator. Let go of the idea that you need to remember your passwords. And definitely stop using the same password on multiple sites.

Make sure 2-factor authentication (2FA) is on. If you’re one of those people who thinks 2FA is inconvenient, stop being that person. If your login credentials are stolen, 2FA is the first line of defense. The most convenient method is to have a code sent via text. You’ll be immediately notified if someone tries to sign in to your account, and you don’t need a smartphone. Authentication apps are slightly faster and a bit more reliable, but they of course require a smartphone.

*There was a recent breach of the European Commission database, but that would not have made her account vulnerable in this way.

[emacs-unofficial]

[chaotic-pulsar]

Mutuals please, I'm begging you. Turn on two-factor authentication.

Also, if you get a message and you THINK you might be scammed, please reach out to your local friendly neighborhood I.T. guy. If you don't have one, please reach out to ME, because losing your account SUCKS and is an awful, awful place to be.

[techniktagebuch]

31. Januar 2026

Mein kleines Token

Ich arbeite an einer Uni. Um Email, Cloud und alles mögliche andere an der Uni zu verwenden, braucht man ein Passwort, und, wenn man von zu Hause arbeitet, außerdem noch irgendwas Zusätzliches – die berüchtigte “Two Factor Authentification”, oder kurz 2FA. Anfangs erhielt ich als 2FA einfach eine SMS an mein Handy, ich habe vergessen, was da genau passierte. Aber zu Hause habe ich fast keinen Handyempfang. Deshalb bin ich vor einiger Zeit auf die 2FA-App umgestiegen (beziehungsweise eine der Apps, die Uni verwendet mehrere, je nach Kontext, man hat es nicht einfach). Wenn ich mich einlogge, kriege ich einen Zahlencode angezeigt, den ich dann über die App eingeben muss. 

Vor einer Woche erhielt ich eine Email, in der stand, dass diese App demnächst auf meinem Android-Handy älterer Bauart nicht mehr funktionieren wird. “Ältere Bauart” heißt “nicht erst gerade gestern gekauft” oder so. Ich solle mich doch mal darum kümmern. Als Alternative bietet man mir ein Token an. Drei Tage später ist das Token in meinem Büro angekommt: Ein Plastikding mit einem Display und einem Umhängeband. Es wirkt ungemein kompetent.

Als ich mich das nächste Mal von zu Hause einlogge, schalte ich die 2FA auf Tokenbetrieb um. Auf dem Token erscheint ein sechsstelliger Code, den ich im Browser beim Einloggen eingebe, und schon bin ich drin. Es kommt mir alles komisch vor, weil dieses kleine Ding ja sicher nicht mit der Uni kommuniziert. Tut es auch nicht, wie mir erklärt wird. Das Token hat eine Nummer, die das Uni-Netzwerk kennt. Aus der Nummer generiert es einen Code, aus dem die Uni erkennt, dass ich es bin. Mehr Details weiß ich auch nicht. Und so sieht das Gerät aus, das ich demnächst ganz sicher stundenlang in der Wohnung suchen werde.

(Aleks Scholz)

[cybersecuritymara]

Internet Safety: Part 2

AKA: What are the odds?

It's a fair question to ask - what are the odds?

You should always be able to make assessments based on risk.

The issue is that calculating the risk of being hacked isn't what you think it is (probably).

Most people look at the risk like this:

Why would a hacker target me? I'm nobody, I'm unimportant. This is just my fanfic account, if they want my smut, they can have it. If they want my spam mails from Amazon, they can have my email.

But that's not the actual risk.

So let's look at that together.

Let me start by asking you about your password.

How did you create it?

Do you use it anywhere else?

If it's generated by a password manager, is that password manager the one built into your browser?

How long is it?

When you added complexity to it, did you just add a 1 to the end? Your birth year? Maybe an underscore between words?

All of these things should be factoring into your risk calculation.

You can see my password advice and how easy it is to crack a password here.

So why the hell does this matter to the odds?

Let's say you use the browser-native password manager to create that password - what else could they potentially have access to, if they have that password? Your Google account? Do you have a banking app on your phone? Do you store your banking password in your browser-native password manager? What else is in there?

Risk isn't just inherent to the one thing that someone may have access to, it's lateral.

If someone gains access to one thing, what else can they gain access to?

Crowdstrike has a good summary of lateral movement here.

Effectively, any attacker, once they have access, may try to access other things - the higher the value, the higher the odds.

Do you value your banking information? Of course you do! So how can someone get from accessing your Gmail to your banking? Is the app installed on your Android phone? Is the password the same? Is the password stored in your Google password manager? All things you have to consider for risk.

I know what you're thinking: that's all well and good, but what are the actual odds someone's going to target me?

You specifically? Some random unknown person on the internet? A direct target on you yourself? Probably not that high, to be honest.

But that's not where the conversation ends.

Because you don't have to be the specific target to get hacked, you just have to be the easiest.

Let's look at an example: call centre scammers.

They have no idea who's calling them.

They didn't specifically put that fake virus message on your computer, they just put it out in the wild and let it go nuts. Whoever calls, calls.

It's the same for your online accounts and information.

A bad actor can obtain your login information from any given data breach on the dark web. (You can check haveibeenpwned to see if your email's been in a breach - if it has, change your password right away anywhere you use that password/email combination, and check your account activity/logins)

Which means that in a majority of cases, they already have your login information.

And not because you necessarily were the target, but because you were easy.

Also, you have to consider the version of something you're using.

I know we all hate updating our software.

Upgrading from Windows 10 to 11.

Installing that next update that gives the app a new look you just don't like, so you avoid it to keep the old look.

But hidden behind those updates are security patches, things that make your system more secure against attacks.

And if you're avoiding those updates and your computer is on the internet, someone can easily find you.

There's a whole-ass tool online out there that people can use to look for out of date systems.

Again, they're not targeting you, they're targeting the weakness that you're broadcasting to the world.

All it takes is one quick search and a random click on a red dot that happens to be your computer.

Update your computer, get a different operating system if you have to.

If you're not using your system for anything too heavy or Steam games, try something like Linux Mint or ZorinOS, which are designed to have a similar feel to more classic Windows experiences.

Get a password manager.

PC Mag has a list of free password managers for 2026 here, if you can't afford a paid version.

When considering risk, considering the odds that you specifically are the target, stop right there. And instead consider whether you are an easy target instead.

And FFS get MFA set up. If you don't want to use Google or Microsoft, Proton has one you can use.