#two factor authentication

[timmadethat]

For anyone infuriated by the unending demands to input a texted code, confirm an email address, open the microsoft authenticator app with your phone pin, input the secure passkey, declare yourself to be human, and desperately try to remember your best friend's name when you were 11, just to do seemingly the most basic task...

[yours-trudy]

Huge pain in the pass.

[smellslikebot]

heads up for anyone using Authy for 2FA

authy's desktop app is being discontinued on March 19, 2024-- apparently moved up from an initially-planned date of August 19 for some reason

i think authy gets recommended a lot specifically for having a desktop option, and the EOL announcement email ended up in my spam folder, so i figured i should try to spread the word.

as far as potential alternatives go, so far i've found ente Authenticator, which has apps for Android and iOS and apparently allows you to access your 2FA codes on web as well. there's also 2FAS, which is open source and has a browser extension, but it sounds like the extension still requires your phone and they recently launched an NFT project(???) so... ymmv!

(of course there are plenty of good mobile-only authenticators, but again, the appeal of authy was that it enabled you to access your keys even if you lost your smartphone or didn't have one in the first place)

[answrs]

trying to do the 2FA after this whole entire mess but apparently I need to download an authenticator app (rather than the type I'm used to where you get a text or email with a secondary code to log in with). does anyone have suggestions on relatively lightweight but secure authenticators on an android? genuinely looking for opinions and suggestions

(obviously I'm not sourcing my entire security to random people on tumblr but I would absolutely deeply appreciate suggestions on some apps to start looking into rather than, say, throwing a dart blindfolded at the five billion scams/shitty ones on the app store and hoping for the best :'v )

[thestargayzingbackup]

Weird update.

So I still don't have the 2fa gotten rid of yet to log back into my old account but I did want to preserve this weird thing.

My tumblr accounts have somehow fused together. Like I should be using the backup one I made yesterday yet I'm able to see my old blogs and everything, but I can't interact with them. ITS SO WEIRD

[porgthespacepenguin]

1. How to setup 2FA on your accounts

As some of you may know, my friend @why-its-kai's Discord account was taken over this morning by a scammer.

The scam they used was this one, or close enough; but anyway, the exact specifics don't matter.

What matters is, it can happen to you. It can happen to anyone.

The good news is, you can learn how to protect yourself. Making some small changes can already improve your online security by leaps and bounds.

I made a series of 3 posts covering the basics:

How to setup 2FA on your accounts (you are here!)

How to spot a scam

How to set up a password manager.

Protect yourself with 2FA

Two-factor authentication, or 2FA, isn't a silver bullet -- but it exponentially increases your online safety by adding an extra step to the login process that a hacker/scammer does not have access to.

Every account that you care about (and even those you don't) should have some form of 2FA enabled.

Especially email -- should your email become compromised, this can become a catastrophe.

(For websites that don't support 2FA, use a burner email!)

What 2FA should I use?

2FA can take many forms, from the highly convenient (SMS, email) to the highly secure (security keys), but one thing is certain:

Any form of 2FA is better than nothing.

The simplest forms of 2FA are phone number or email. While these are very easy to use, they are unfortunately not very secure.

Still, I repeat: despite their flaws, these forms of 2FA are absolutely, 100% better than not having any 2FA at all.

On the other end of the spectrum, security keys (like for example a Yubikey) are extremely secure, but they cost money and are a bit of a hassle at time. I use them, but for most people, it's overkill.

What you want is an authenticator app.

Important

A note, before we go on…

If you enable multiple forms of 2FA, how secure your account is will depend on your weakest link.

For example, if you enable SMS authentication AND register a security key, your account will only be as safe as the SMS authentication. The security key is essentially useless.

In other words, the least secure form of 2FA you add determines the overall security of your account.

Sometimes, less is more!

Authenticator Apps

First, choose a free, reputable authenticator. Google Authenticator is a good choice. So are Aegis Authenticator or Microsoft Authenticator.

For simplicity, we'll go with Google Authenticator; the process is rather similar for most authenticators.

First, download the app from your app store and install it on your phone.

Enrolling Gmail into GA

Securing your email should be your number 1 priority, so let's enroll a Google account to Google Authenticator.

Let's enable two-step verification first.

Phone number is better than nothing, but not very safe (SMS verification can be spoofed), so let's click on "Add authenticator app".

Click on "Set up authenticator". Google will generate a QR-code.

Next, go back to your phone and click on the little multicolored cross. It will bring up a menu; click on "scan a QR code".

Go ahead and scan the QR code.

Congratulations, you have enrolled your Google account!

Now, whenever you are asked for a 2FA code, just open the app and copy/paste it.

Note: the codes are stored locally on your phone.

Enabling 2FA on Discord

The process is fairly similar. Go to Settings > My Account:

Click on "Enable Authenticator App". You will be prompted for your password. Enter it.

Download Google Authenticator if you haven't already. Scan the QR code as described above.

Do take the time to download your backup codes as well!

As explained above, I personally do not recommend setting up SMS authentication here, since authenticator apps are supported, as this weakens the overall security of your account for little benefit.

Stay tuned for parts 2 and 3!

If you have any questions, feel free to PM me.

[foobars-cool-car]

i should write an essay about adhd and 2factor authentication/online textbooks

[pixiereblogs]

Pixie Recaps Picard | Dominion