Conversation

Notices

1. Embed this notice
   Scary Jerry 👻 (jerry@infosec.exchange)'s status on Thursday, 18-Jun-2026 01:57:09 JST Scary Jerry 👻

   Mastodon 4.6 released today. It lets me force 2FA on accounts.

   Also, heads up, I am going to force 2FA on accounts.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 18-Jun-2026 01:57:09 JST Rich Felker

     in reply to

     @jerry Really not cool excluding folks for whom "something you have" is not tenably stable.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 18-Jun-2026 02:03:22 JST Rich Felker

     in reply to

     @jerry I wonder if something like requiring a promise to use decent passwords in order to opt out of 2FA and a $50+ account recovery fee for compromised accounts would work.

   • Embed this notice
     Scary Jerry 👻 (jerry@infosec.exchange)'s status on Thursday, 18-Jun-2026 02:03:23 JST Scary Jerry 👻

     in reply to

     • Rich Felker

     @dalias I don't have a lot of options. I am frequently battling account takeovers from weak passwords and stolen passwords.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 18-Jun-2026 07:25:10 JST Rich Felker

     in reply to

     • pete

     @novet @jerry And if you access the web from a public library?

   • Embed this notice
     pete (novet@infosec.exchange)'s status on Thursday, 18-Jun-2026 07:25:11 JST pete

     in reply to

     • Rich Felker

     @dalias @jerry most password managers can store TOTP secrets and will generate codes for you. accessible through web browsers, which (if you're accessing fedi) you probably also have access to.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 18-Jun-2026 08:54:44 JST Rich Felker

     in reply to

     • pete

     @novet @jerry Yeah it's not great but generally public libraries work in the interests of the ppl they serve, and if you don't have your own devices because cops keep taking and trashing them in sweeps, or your abusive partner/parent keeps taking or searching your devices, or...

   • Embed this notice
     pete (novet@infosec.exchange)'s status on Thursday, 18-Jun-2026 08:54:45 JST pete

     in reply to

     • Rich Felker

     @dalias @jerry you can still access a password manager from a public library? obviously there are different security implications.

     im personally against logging into my accounts on anything i don't own but i understand this doesn't apply to everyone.