News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by userbinator on Friday March 29, 2024 @08:36PM (#39870627)
It's more to make the point that "no means no." An act of protest.

(I have written a TOTP implementation myself. I do not have a GH account, and likely never will.)

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Dylan16807 on Friday March 29, 2024 @08:48PM (#39870712)
It's ridiculous to say "no means no" about not wanting to use a password to get an account, right?

What makes TOTP different from a password in terms of use or refusal?

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by ndriscoll on Friday March 29, 2024 @10:45PM (#39871390)
Browsers don't save the TOTP seed and auto fill it for you for one, making it much less user friendly than a password in practice.

The main problem I have with MFA is that it gets used too frequently for things that don't need that much protection, which from my perspective is basically anything other than making a transfer or trade in my bank/brokerage. Just user-hostile requiring of manual action, including finding my phone that I don't always keep on me.

It's also often used as a way to justify collecting a phone number, which I wouldn't even have if not for MFA.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by saagarjha on Saturday March 30, 2024 @08:43AM (#39874324)
Mine does. Yours doesn't?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jeromegv on Saturday March 30, 2024 @09:15AM (#39874561)
We are talking of non-SMS MFA
[ Parent | on HN ]