News for hackers. Stuff that matters.

A comment on Requiring MFA on popular gem maintainers. Parent comment

Re:Requiring MFA on popular gem maintainers by chrisseaton on Tuesday August 16, 2022 @09:49AM (#32482693)
No that’s the normal codes, which are time limited. A backup code could be 40 digits or something like that.
[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by 8organicbits on Tuesday August 16, 2022 @10:04AM (#32482882)
Most I've seen are 6 digits for both the TOTP and the recovery. Who is using 40 digits for an MFA recovery code?
[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by MiguelX413 on Tuesday August 16, 2022 @10:10AM (#32482958)
Most services I use give several 6~8 digit recovery codes, I've never had discretion with them. I have no idea what they're talking about.
[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by chrisseaton on Tuesday August 16, 2022 @10:16AM (#32483035)
> Most services I use give several 6~8 digit recovery codes

Well RubyGems itself, subject of this post, has 12 for a start.

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by tialaramex on Tuesday August 16, 2022 @06:55PM (#32490071)
The most you've seen for a recovery code is 6 digits? Where have you seen these "never more than 6 digits" codes ?

GitHub's codes are 8 alphanumerics,

Dropbox 8 alphanumerics,

Live.com offers a 25 alphanumerics

Google 8 numeric

Facebook 8 numeric

Nintendo 8 numeric

Login.gov 12 alphanumerics

Gitlab 16 hexadecimal

I'm sure some fool somewhere used a six digit numeric "recovery code" but the usual, while it isn't 40 is certainly more than 6.

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by 8organicbits on Wednesday August 17, 2022 @09:49AM (#32496349)
I must be mistaken, looks like 8, those are the sites I use.
[ Parent | on HN ]