News for hackers. Stuff that matters.

A comment on Heroku resetting passwords for “a portion” of their users immediately. Parent comment

Re:Heroku resetting passwords for “a portion” of their users... by jrochkind1 on Wednesday May 04, 2022 @09:55AM (#31260445)
OH, I see, thanks. The password and TOTP secret are separate, but you're suggesting they may likely both be stored in the same place such that a breach could give attacker access to both. Tell me if I don't have it right.

It occurs to me that I know how to reset my password most places I log in to, but I actually have no idea how to reset the TOTP secret.

[ Parent | on HN ]
Re:Heroku resetting passwords for “a portion” of their users... by bigDinosaur on Wednesday May 04, 2022 @10:27PM (#31268646)
It might be stored separately, the issue is just with an uncontained breach I suppose.
[ Parent | on HN ]