I guess it's better late than never.
GOG add support for authenticator apps for two-factor authentication (2FA)
Administered by:
#multifactorauthentication
0 posts0 participants0 posts today
What Every Business Needs To Know About Multi-Factor Authentication https://www.byteseu.com/1008688/ #business #CybersecurityStrategies #MultiFactorAuthentication #OrganizationalResilience
Why MFA is getting easer to bypass and what to do about it - An entire cottage industry has formed around phishing attacks that bypass ... - https://arstechnica.com/security/2025/05/phishing-attacks-that-defeat-mfa-are-easier-than-ever-so-what-are-we-to-do/ #multifactorauthentication #passwords #security #phishing #webauthn #biz #mfa
Ars Technica · Phishing attacks that defeat MFA are easier than ever. So what are we to do?
"GitHub noreply@github.com
Fri, Dec 13, 7:12 PM (12 hours ago)
to me
Hey [redacted]!
We're reaching out to let you know that, as announced last year, we have officially begun requiring users who contribute code on GitHub.com to have two-factor authentication (2FA) enabled.
Your account meets this criteria, and you will need to enroll in 2FA within 45 days, by January 27th, 2025 at 00:00 (UTC). After this date, your access to GitHub.com will be limited until you enroll in 2FA. Enrolling is easy, and we support several options, starting with TOTP apps and text messages (SMS) and then adding on passkeys and the GitHub Mobile app."
Fucking GitHub.
It's not 2FA.
2FA is two factors.
A username and a passphrase are already two factors!
Also see: Citadel BBSes, where they only asked for a passphrase (one factor authentication).
Well, unless SysOps turned on "paranoid mode" which then prompted for a username and a passphrase, thus: TWO factor authentication.
Whatever bull it.sh GitHub is on about again is MFA (Multi-Factor Authentication) but they're too fucking stupid to use the correct terminology and since they were bought by Micro$oft they're never going to get smarter, only dumber.
I remember dealing with something similar from them a year or two ago?
I enumerated, I think as many as six, possibly seven different authentication factors?
As it stands:
1. username
2. passphrase
3. often (but not always) when attempting to login from a different IP/browser/whathaveyou it will send a "Verification Code" to the associated email address (so at least three, but maybe 4 depending on how you count)
4. SSH keys. When I checkout/clone a repository/branch/fork and push changes, it prompts me for an SSH key.
5. My SSH keys are also passphrase protected.
6. Passkeys are an option (apparently, I feel as if since I am already using no fewer than 4-5 authentication factors, adding 6 is starting to get fucking idiotic).
7. TOTP options? (That requires like: an app or a physical dongle/token, and apps also require phones, so that's really more like 8)
8. SMS/text messages aka Phone numbers (which also require a phone and a subscription/service so maybe more like 9) Moreover, given that EVEN THE FBI is recommend people STOP USING TEXT MESSAGES? THIS HAS TO BE THE FUCKING STUPIDEST IDEA EVER!
What was wrong with just sending a verification code to an SMTP address during login attempts like you have already been doing for fucking years?
I hate GitHub.
If you don't hate GitHub, I think: maybe you aren't experienced enough to understand why anyone would hate them.
But great, now I have 45 days to jump through some more bull it.sh because GitHub is staffed by absolute morons apparently.
Or maybe GitHub has been replaced by an LLM which can't count above two? Maybe that would explain it and their absolutely atrocious demeaning of terminology when more accurate terminology has existed for an awfully long time already.
Of course, GitHub aren't the only morons to misuse the phrase 2FA when they should be using the phrase MFA; but I don't tend to encounter the other morons insisting I enable 2FA when I am already using at least 4 authentication factors in any given code modification with their shitty hosted proprietary DVCS.
#GitHub #2FA #MFA #MultiFactorAuthentication #GitHubCannotCount #SecurityTheater #Bullshit
Fri, Dec 13, 7:12 PM (12 hours ago)
to me
Hey [redacted]!
We're reaching out to let you know that, as announced last year, we have officially begun requiring users who contribute code on GitHub.com to have two-factor authentication (2FA) enabled.
Your account meets this criteria, and you will need to enroll in 2FA within 45 days, by January 27th, 2025 at 00:00 (UTC). After this date, your access to GitHub.com will be limited until you enroll in 2FA. Enrolling is easy, and we support several options, starting with TOTP apps and text messages (SMS) and then adding on passkeys and the GitHub Mobile app."
Fucking GitHub.
It's not 2FA.
2FA is two factors.
A username and a passphrase are already two factors!
Also see: Citadel BBSes, where they only asked for a passphrase (one factor authentication).
Well, unless SysOps turned on "paranoid mode" which then prompted for a username and a passphrase, thus: TWO factor authentication.
Whatever bull it.sh GitHub is on about again is MFA (Multi-Factor Authentication) but they're too fucking stupid to use the correct terminology and since they were bought by Micro$oft they're never going to get smarter, only dumber.
I remember dealing with something similar from them a year or two ago?
I enumerated, I think as many as six, possibly seven different authentication factors?
As it stands:
1. username
2. passphrase
3. often (but not always) when attempting to login from a different IP/browser/whathaveyou it will send a "Verification Code" to the associated email address (so at least three, but maybe 4 depending on how you count)
4. SSH keys. When I checkout/clone a repository/branch/fork and push changes, it prompts me for an SSH key.
5. My SSH keys are also passphrase protected.
6. Passkeys are an option (apparently, I feel as if since I am already using no fewer than 4-5 authentication factors, adding 6 is starting to get fucking idiotic).
7. TOTP options? (That requires like: an app or a physical dongle/token, and apps also require phones, so that's really more like 8)
8. SMS/text messages aka Phone numbers (which also require a phone and a subscription/service so maybe more like 9) Moreover, given that EVEN THE FBI is recommend people STOP USING TEXT MESSAGES? THIS HAS TO BE THE FUCKING STUPIDEST IDEA EVER!
What was wrong with just sending a verification code to an SMTP address during login attempts like you have already been doing for fucking years?
I hate GitHub.
If you don't hate GitHub, I think: maybe you aren't experienced enough to understand why anyone would hate them.
But great, now I have 45 days to jump through some more bull it.sh because GitHub is staffed by absolute morons apparently.
Or maybe GitHub has been replaced by an LLM which can't count above two? Maybe that would explain it and their absolutely atrocious demeaning of terminology when more accurate terminology has existed for an awfully long time already.
Of course, GitHub aren't the only morons to misuse the phrase 2FA when they should be using the phrase MFA; but I don't tend to encounter the other morons insisting I enable 2FA when I am already using at least 4 authentication factors in any given code modification with their shitty hosted proprietary DVCS.
#GitHub #2FA #MFA #MultiFactorAuthentication #GitHubCannotCount #SecurityTheater #Bullshit
Very impressed with #NewMexico's #Healthcare #Exchange website. Both from a UI/UX standpoint and from in infosec standpoint.
They made me pick a strong password, and they immediately opted me in to setting up #TOTP #MultiFactorAuthentication. Not only that, but they had a link to show me the TOTP secret so I wouldn't have to scan the QR code!
This from a government website.
Very impressed.
And signing up and picking an Exchange health plan during this open enrollment period was a breeze.
I did not pick a #UnitedHealthCare plan. ;-)
The Metal Dog #TheMetalDogArticleList
#MetalInjection
SYSTEM OF A DOWN's Drummer JOHN DOLMAYAN Is An Inventor Now
"It can eliminate massive amounts of waste."
https://metalinjection.net/news/system-of-a-downs-drummer-john-dolmayan-is-an-inventor-now
Google makes it easier for users to switch on advanced account protection - Enlarge (credit: Getty Images)
Google is making it easier for ... - https://arstechnica.com/?p=2036985 #multifactorauthentication #passwords #security #passkeys #biz #google
Ars Technica · Google makes it easier for users to switch on advanced account protectionThe strict requirement for two physical keys is now eased when passkeys are used.
Hackers steal “significant volume” of data from hundreds of Snowflake customers - Enlarge (credit: Getty Images)
As many as 165 customers of clo... - https://arstechnica.com/?p=2030619 #multifactorauthentication #databreaches #snowflake #security #biz&it
Ars Technica · Hackers steal “significant volume” of data from hundreds of Snowflake customersGiven shortcomings of Snowflake and its customers, there's plenty of blame to go around.
LastPass users targeted in phishing attacks good enough to trick even the savvy - Enlarge (credit: Getty Images)
Password-manager LastPass users... - https://arstechnica.com/?p=2018339 #multifactorauthentication #credentialphishing #security #lastpass #biz&it
Ars Technica · LastPass users targeted in phishing attacks good enough to trick even the savvyCampaign used email, SMS, and voice calls to trick targets into divulging master passwords.
Looking for a reliable TOTP Authenticator app? I've been using @ente auth for a while now.
#OpenSource - Check out their code at https://github.com/ente-io/auth
End-to-End Encrypted Backups
Multi-Device Support
Offline Mode 
Cross-Platform
Go to https://auth.ente.io to access your codes on your desktop. Make the switch to ente auth and take back control! 
GitHubGitHub - ente-io/auth: 2FA app for Android, iOS and web, with free end-to-end encrypted backup and sync2FA app for Android, iOS and web, with free end-to-end encrypted backup and sync - GitHub - ente-io/auth: 2FA app for Android, iOS and web, with free end-to-end encrypted backup and sync
Enforcing Viewer Login MFA in Second Life
Learn more: https://second.life/mfa091923
Frontegg launches entitlements engine to streamline access authorization - Frontegg’s new entitlement engine will be powered by context-aware logic controls (CALC) ... - https://www.csoonline.com/article/3697735/frontegg-launches-entitlements-engine-to-streamline-access-authorization.html#tk.rss_all #multifactorauthentication #authentication
CSO OnlineFrontegg launches entitlements engine to streamline access authorizationFrontegg’s new entitlement engine will be powered by context-aware logic controls (CALC) technology to effect context-based, fine-grained authorization controls.
Referenced link: https://hackernoon.com/how-adaptive-mfa-helps-businesses-safeguard-against-phishing-attacks
Discuss on https://discu.eu/q/https://hackernoon.com/how-adaptive-mfa-helps-businesses-safeguard-against-phishing-attacks
Originally posted by HackerNoon | Learn Any Technology / @hackernoon: http://nitter.platypush.tech/hackernoon/status/1649820416754499586#m
MFA is an essential security feature for protecting your accounts from unauthorized access. How to implement phishing-resistant MFA to prevent hackers - https://hackernoon.com/how-adaptive-mfa-helps-businesses-safeguard-against-phishing-attacks #cybersecurity #multifactorauthentication
hackernoon.comHow Adaptive MFA Helps Businesses Safeguard Against Phishing Attacks | HackerNoonMFA is an essential security feature for protecting your accounts from unauthorized access. How to implement phishing-resistant MFA to prevent hackers
Why is Identity Security Awareness Becoming the Need of the Hour? - Customer identity security is essential to running a business in the digital age. ... - https://readwrite.com/why-is-identity-security-awareness-becoming-the-need-of-the-hour/ #multifactorauthentication #securityawareness #identitysecurity #dataandsecurity #digitalidentity #strongpasswords
ReadWriteWhy is Identity Security Awareness Becoming the Need of the Hour?Why customer identity security awareness is crucial for businesses and what they can do to ensure their customer's information is safe.
Still using authenticators for MFA? Software for sale can hack you anyway
https://arstechnica.com/?p=1924036
#multifactorauthentication #two-factorauthentication #accounttakeovers #phishing #Biz&IT #2fa #mfa
Ars TechnicaSoftware for sale is fueling a torrent of phishing attacks that bypass MFASome forms of multi-factor authentication only go so far in preventing account takeovers.
Still using authenticators for MFA? Software for sale can hack you anyway - Enlarge (credit: Getty Images)
Microsoft on Tuesday profiled s... - https://arstechnica.com/?p=1924036 #multifactorauthentication #two-factorauthentication #accounttakeovers #phishing #biz #2fa #mfa
Ars TechnicaSoftware for sale is fueling a torrent of phishing attacks that bypass MFASome forms of multi-factor authentication only go so far in preventing account takeovers.
Ars Technica: Still using authenticators for MFA? Software for sale can hack you anyway https://arstechnica.com/?p=1924036 #Tech #arstechnica #IT #Technology #multifactorauthentication #two-factorauthentication #accounttakeovers #phishing #Biz&IT #2fa #mfa
Ars TechnicaSoftware for sale is fueling a torrent of phishing attacks that bypass MFASome forms of multi-factor authentication only go so far in preventing account takeovers.
"MFA Weaknesses
Why do we need a new approach to authentication? Bypassing existing MFA techniques to garner employee credentials or to take over employee accounts has become child's play for attackers. There are even videos on YouTube explaining how to do it. Techniques range from simple phishing to push bombing — where attackers send push notifications until the employee accepts one — to more complex SS7 communications protocol exploits to obtain texted MFA codes.
For example, take the common MFA technique of using a push notification as the second factor.
One common approach the attackers use is to create a fake company login page, then send out phishing emails to drive employees to that page. When an employee enters their username and password into the fake page, the attacker simply takes the credentials and enters them into the real login page. When the employee receives the MFA request (the push notification), they are likely to treat it as genuine and click "Yes." With that simple approach, the attacker has now compromised the employee's account and has a beachhead into the company's network that can allow them to move laterally and install malware or ransomware.
People as a Point of Failure
Not all vulnerabilities are technical. Social engineering is becoming more sophisticated, with attackers using texts and voice calls targeted at specific employees to add credibility and urgency to that phishing email. The attackers pose as IT technicians or other trusted authorities to create that trust with the targeted employee. These techniques can be very effective, as hapless users willingly will do as asked, assuming they are speaking with a trusted person from their own organization.
Enter the FIDO2 Standard
So, what is FIDO2, and how can it help address these MFA vulnerabilities? Developed by the Fast Identity Online (FIDO) Alliance, FIDO2is an authentication method containing two components: WebAuthn (W3C) and CTAP (FIDO Alliance), which together eliminate the security gaps in standard MFA services. #security #people #malware #2fa #mfa #twofactorauthentication #multifactorauthentication #cybersecurity
https://www.darkreading.com/endpoint/without-fido2-mfa-falls-short
Dark ReadingWithout FIDO2, MFA Falls Short
https://redbeardsec.com/what-does-mfa-stand-for-the-meaning-of-mfa/
Ensure your #cybersecurity is up to date - use #multifactorauthentication for an extra layer of protection for your accounts and data! #securityawareness #mfa #cyberdefense #cyberawareness #datasecurity #dataprotection