461

Multifactor auth done right (l.roofo.cc)

submitted 11 months ago by chris@l.roofo.cc to c/programmer_humor@programming.dev

17 comments fedilink hide all child comments

Original https://icosahedron.website/@halcy/111631878003850824

all 19 comments

sorted by: hot top controversial new old

[-] bjoern_tantau@swg-empire.de 56 points 11 months ago

They forgot something old, something borrowed and something blue.

[-] HeckGazer@programming.dev 28 points 11 months ago

Wow would you look at that, still none of them cover what SMS is >:( Almost like it's not a second factor, and fuck every corporation that tries to claim that it is

[-] JPAKx4 42 points 11 months ago

SMS is something you have, IE access to your phone. Doesn't mean it's the best option, SMS is notorious for being insecure

[-] HeckGazer@programming.dev 5 points 11 months ago

The 10,000 support staff with dubious social engineering training at your service provider are not "something you have". Case in point literally a few weeks ago https://arstechnica.com/tech-policy/2023/12/verizon-fell-for-fake-search-warrant-gave-victims-phone-data-to-stalker/

[-] Kethal@lemmy.world 1 points 11 months ago* (last edited 11 months ago)

This is an article describing someone impersonating an officer and submitting a fake warrant. It's incredible that Verizon fell for it, but what does it have to do with SMS?

[-] AVincentInSpace@pawb.social 1 points 10 months ago

It means that if I want access to something that has been texted to you, I don't exactly need to be a government in order to get it.

[-] jaybone@lemmy.world 6 points 11 months ago

It would be fine if it weren’t for sim swapping.

But try asking anyone at your bank about a yubikey and watch them stare at you like you have broccoli growing out of your ears.

[-] Cannacheques@slrpnk.net 16 points 11 months ago

Something random as fuck like what hand your married to and when you broke up with your hand and married your other hand

[-] sv1sjp@lemmy.world 13 points 11 months ago

As I Cybersecurity Consultant, I totally agree

[-] MCHEVA4EVA@lemmy.world 8 points 11 months ago

I get my passwords from the collective unconsciousness.

[-] Natanael@slrpnk.net 6 points 11 months ago

There needs to be an SCP for a password manager

[-] Kissaki@programming.dev 4 points 11 months ago

One time passwords

Forgotten after one use

[-] kherge@beehaw.org 8 points 11 months ago

That last one reads like C’thulhufactor.

[-] EpeeGnome@lemmy.fmhy.net 6 points 11 months ago

Now I want to go play Cultist Simulator or Book of Hours. This list is also a list of the sorts of cards the games use to represent the narrative/puzzle you're playing through. Highly recommend.