News for hackers. Stuff that matters.

A comment on Requiring MFA on popular gem maintainers. Parent comment

Re:Requiring MFA on popular gem maintainers by ValentineC on Tuesday August 16, 2022 @10:27AM (#32483183)
>> More and more services are moving towards 2FA/MFA. The 2nd factor is in a phone app. What happens if I lose my phone? Without my old phone I cannot log into the services. How do I get access to my accounts again? How do I move the 2FA setup to new phone again? Do I have to do this one by one for all 50 2FAed services I use?

> Many services seem to offer one-time codes for storage offline in case this happens.

Adding on: even password managers like 1Password [1] and Bitwarden [2] offer support for TOTP 2FA now.

[1] https://support.1password.com/one-time-passwords/

[2]https://bitwarden.com/help/authenticator-keys/

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by nisegami on Tuesday August 16, 2022 @10:33AM (#32483258)
The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager.

But a good single factor is probably fine.

[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by giaour on Tuesday August 16, 2022 @10:38AM (#32483319)
It's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).
[ Parent | on HN ]
Re:Requiring MFA on popular gem maintainers by worble on Tuesday August 16, 2022 @10:39AM (#32483348)
To be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.
[ Parent | on HN ]