Recent searches

No recent searches

Search options

Not available on mastodon.zunda.ninja.
mastodon.zunda.ninja is one of the many independent Mastodon servers you can use to participate in the fediverse.
Zundon is a single user instance as home of @zundan as well as a test bed for changes of the code.

Administered by:

Server stats:

1
active users

mastodon.zunda.ninja: AboutPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.5.0-alpha.1+e46cdd94-ruby-3.4.5

#2fa

0 posts0 participants0 posts today
Avoid the Hack! :donor:

Lots of new followers (hi!) recently. Some of you are in the #infosec or #cybersecurity communities, the #privacy community, both, or neither. I post privacy and #security related things for individuals and small/micro organizations.

Some are looking for a place to “get started” with improving their privacy and/or security online. In any case, privacy and security start with some basics that I strongly believe everyone should do:

1. Develop good password management practices, which includes NOT reusing #passwords.

2. Keep your device #software and firmware updated.

3. Use multifactored authentication #mfa / two-factored authentication #2fa

Security is a process. It is also the foundation to online privacy; what good is it to use an encrypted email service if you are reusing weak passwords from your other online accounts?

avoidthehack.com/getting-start

c_th1

Meine Datenschutz und Privatsphäre Übersicht, für den allgemeinen Gebrauch.

( stand: Januar 2024 )

(10.01.2024
Die Schweiz liest mit
es ist unbekannt ob Threema und Proton,
noch sicher sind.

wollte Ich hiermit nur ergänzen

www. republik.ch/2024/01/09/der-bund-ueberwacht-uns-alle )

#DSGVO #Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#Email
#GOOGLE
#FACEBOOK #WHATSAPP #Threema
#Hateaid #Cyberstalking
#Messenger #Browser #Youtube #Piped #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Appel #Windows
#Linux #Matrix #Mastodon #Fediverse #2FA #Ransomware

Codeberg.org

Friendly Reminder to #2FA users: Imagine your primary machine fails today. How will you restore your access to your online accounts?

Please ensure you saved your scratch token somewhere and have working backups of your TOTP app or a backup hardware key.

Thank you!
#Backup

Stark

@protonmail are there any plans to change the fact that #ProtonPass uses the same password as our #ProtonMail, #ProtonDrive and #ProtonCalendar? It just seems like a design flaw and security concern?

For example, I can't use ProtonPass to store a randomly generated password for my email, as it uses my #Proton account. Also, assuming I now use a password for my ProtonMail, if the password becomes comprised in whatever way, my password manager is also compromised.

This effect is cascaded by the fact that ProtonPass can be used as a #passwordmanager and #2FA, so I can't use it for my 2FA for my email.

This is probably one of my few reasons to not switch from #Bitwarde.

#Security#Privacy
Continued thread
Marcel Waldvogel

4️⃣ Cloud untergräbt Sicherheit von Zwei-Faktor-Authentifizierung (2023-09)
Zwei-Faktor-Authentisierung ist ein wichtiger Aspekt zur Sicherung unserer Online-Infrastruktur und -Daten. Leider erfordert sie ein paar zusätzliche Schritte und Vorsichtsmassnahmen. Deshalb haben viele Nutzer sie nicht aktiv. #PassKey soll das vereinfachen. Aber man sollte sie nicht so einfach auf angeblich neue Geräte syncen…
#2FA #MFA
dnip.ch/2023/09/19/cloud-unter

Fast Junkie

#rant

Using @protonmail #ProtonPass is the #nutz... I ❤️ the #2FA functionality...!

Any login credentials I use that has #2FA (#TOTP) I instantly disable it, then re-enable using #ProtonPass instead of #Twillo.

Can be tedious, but totally worth the effort.

Just need that #ProtonPass web app and some better offline access...

When offline, sadly I need to fallback to my old @bitwarden app... which is slowly getting out of sync as I am a #chronic password manipulator...

#rantover
Continued thread
Mysk🇨🇦🇩🇪

.... if someone obtains access to your Google Account, all of your 2FA secrets would be compromised.

Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.
Surprisingly, Google data exports do not include the 2FA secrets that are stored in the user's Google Account. We downloaded all the data associated with the Google account we used, and we found no traces of the 2FA secrets.

The bottom line: although syncing 2FA secrets across devices is convenient, it comes at the expense of your privacy. Fortunately, Google Authenticator still offers the option to use the app without signing in or syncing secrets. We recommend using the app without the new syncing feature for now.

#Privacy#Cybersecurity#InfoSec
*
Mysk🇨🇦🇩🇪

Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.

TL;DR: Don't turn it on.

The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.

We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.

Why is this bad?

Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access .... 🧵

#Privacy#Cybersecurity#InfoSec
Nitrokey

Did you know? #FIDO2 not only enables you to use two-factor authentication. It adds another layer of technical #phishing protection, too. How? Thanks to the built-in security tech, logging in on a fake website doesn't work when using a hardware security key for #2FA. Phew! 😅💪😎

TrendingLive feeds
About