Ya know, I have no issues with 2fa, but I watch older folks struggle with it for some reason. They can't fathom the 'magic'. But I don't understand 2fa on utility websites that are only payment portals that obfuscate account numbers. Like "enable 2fa for account security!" why? Because someone who has found my credentials on the dark web might pay my bill?
I'm also trying to find the angle on it. Like with my ISP I guess someone could have my password but not necessarily my address? So from the ISP site they could peek at my address??? I'm not even sure it has my address unobfuscated but I figure it must somewhere, like "view this bill".
A lot of ISPs provide email, too. So getting an ISP password lets them reset your other passwords which used that email address for the "forgot password" prompt. (I'm guessing you don't use your ISP provided email, but you're not "most people".)
As long as that factor is auth app based, and not email/text/call/proprietary app I’m all in. If I need to go digging for the second factor for 5 minutes, I’m almost always going to turn it off. Texts emails and calls all get delayed regularly, and it’s super fun to have to sit with my thumb up my ass waiting 10 minutes for an OTP that was good for 5.
I think for email it's essential, it's critical that someone doesn't make it into your email. Otherwise they can reset all your other passwords.
I have mfa on my account but I just click a checkbox after first time to not ask again. I'm still protected by it and don't have to do anything until I clear my cookies (which I don't for email).
That’s also a less secure version of 2fa. Granted, it is still better than nothing, but sim spoofing is still a thing that happens regularly. Making it much less useful in a targeted attack.
A smartphone is infinitely more secure than relying on a SIM card not being compromised. A little social engineering can get you access to receive a text as the link isn’t even controlled by you but a third party. An app on your phone is likely secured by a pin/biometric, and a password/pin/biometric, both controlled by you.
Oh cmon, you can get a smartphone literally for free these days. And yes, having a cell phone of some type is pretty much a requirement to live in the 23rd century. Even if you are just communicating over free McDonalds wifi (no shame, been there done that) you pretty much need a smart phone in the modern world.
One time I had to use a website where the email 2FA expired in 30 seconds! I usually keep my email client open while my computer is on, but, come on, that was ridiculous.
Nearly 71 million unique credentials stolen for logging into websites such as Facebook, Roblox, eBay, and Yahoo have been circulating on the Internet for at least four months, a researcher said Wednesday.
breach notification service, said the massive amount of data was posted to a well-known underground market that brokers sales of compromised credentials.
Hunt said he often pays little attention to dumps like these because they simply compile and repackage previously published passwords taken in earlier campaigns.
This isn't just the usual collection of repurposed lists wrapped up with a brand-new bow on it and passed off as the next big thing; it's a significant volume of new data.
When you look at the above forum post the data accompanied, the reason why becomes clear: it's from ‘stealer logs’ or in other words, malware that has grabbed credentials from compromised machines.”
For added assurance, Hunt also checked a sample of the credentials to see if the email addresses were associated with accounts on the affected websites.
The original article contains 645 words, the summary contains 167 words. Saved 74%. I'm a bot and I'm open source!
