News for hackers. Stuff that matters.

A comment on Bucketsquatting is (finally) dead. Parent comment

Re:Bucketsquatting is (finally) dead by zikduruqe on Friday March 13, 2026 @10:56AM (#47365339)
You print the MFA QR code, and give it to an executive that locks it up in a safe or offsite storage.

In a past life, we printed the MFA QR code and the head of finance put it into a safe.

[ Parent | on HN ]
Re:Bucketsquatting is (finally) dead by Arrowmaster on Saturday March 14, 2026 @08:49PM (#47383049)
You know that QR code is just text you can read right? It's just an otpauth:// URI you can copy and paste into most password managers.

We even have these amazing things that securely share passwords or other secret data between multiple authorized users.

Seriously just scan the QR code and put it in any password manager that supports TOTP and it will start outputing codes.

[ Parent | on HN ]
Re:Bucketsquatting is (finally) dead by efitz on Sunday March 15, 2026 @12:02AM (#47384223)
That's precisely why you want it in a safe.
[ Parent | on HN ]
Re:Bucketsquatting is (finally) dead by zikduruqe on Sunday March 15, 2026 @07:22AM (#47386319)
Yes, I am very familiar with zbarimg and qrencode. But, other people might not be, and that's why just scanning a QR code works. Not everyone has Bitwarden, 1Password, Pass, keepass, etc....

And we are talking about the root account for your production AWS account. No need to get fancy. Just print the QR code, and put it in a safe hoping you never need it.

[ Parent | on HN ]