5 ms·

So you're running your own DNS server then too right? A hardened email server doesn't prevent a targeted attacker from just redirecting your mx records (as happ

So you're running your own DNS server then too right? A hardened email server doesn't prevent a targeted attacker from just redirecting your mx records (as happened to OP). > but I don't trust Google, Github, Facebook et al with my phone number Github doesn't require a phone number to use 2FA. And if you don't trust Google or Facebook with your phone number then that means you don't use either of them at all? Because otherwise holding back your phone number from them is a rather pointless exercise as they already know everything about you [1] [1] https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak

omginternets 10y ago
I'm assuming a setup similar to that of the OP's. >And if you don't trust Google or Facebook with your phone number then that means you don't use either of them at all? More or less. Email I can handle, and there's stuff I stupidly gave up in the past, but I see no reason to provide them with additional info. >Github doesn't require a phone number to use 2FA Are you referring to the application? That might be a fair compromise depending on what kinds of permissions the application requires. >A hardened email server doesn't prevent a targeted attacker from just redirecting your mx records (as happened to OP). What on earth are you on about? Of course it does. The OP had a crappy password, which is about as fundamental as it gets with regards to server hardening...
- semanticist 10y ago
  If you don't understand the different types of 2FA available, I don't think you're really in a position to be making blanket statements about if people should be using it or not. "The application" is an open standard called TOTP, which doesn't require any specific application. I just set up 2FA for my personal GitHub account using a TOTP app on my Pebble watch. The actual crypto for the 2FA is done locally on the watch, no other device can spoof it, and GitHub get exactly zero feedback or information from this - other than the 2FA code that I type, of course. There's other ways to do 2FA - U2F is an upcoming standard and people have been using dongle-generated codes from RSA for years. Before making pronouncements that go against current best practices for end users, you really need to get a much better understanding of what you're talking about. Saying nonsense in a confidence voice is enough to convince people that your terrible advice is worth following, and could result in them having worse information security as a result.
- snowwolf 10y ago
  > What on earth are you on about? You can have the most secure/hardened email server on the planet but if I can change your mx record at your dns provider it will do you no good. And there are multiple attacks against DNS that don't require me to target your provider even (e.g. https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing) And once all your emails are being sent to me, I can own every account you've signed up for using that email (through reset password). And currently the only reliable defence against that is 2FA.

omginternets 10y ago

I'm assuming a setup similar to that of the OP's. >And if you don't trust Google or Facebook with your phone number then that means you don't use either of them at all? More or less. Email I can handle, and there's stuff I stupidly gave up in the past, but I see no reason to provide them with additional info. >Github doesn't require a phone number to use 2FA Are you referring to the application? That might be a fair compromise depending on what kinds of permissions the application requires. >A hardened email server doesn't prevent a targeted attacker from just redirecting your mx records (as happened to OP). What on earth are you on about? Of course it does. The OP had a crappy password, which is about as fundamental as it gets with regards to server hardening...

semanticist 10y ago
If you don't understand the different types of 2FA available, I don't think you're really in a position to be making blanket statements about if people should be using it or not. "The application" is an open standard called TOTP, which doesn't require any specific application. I just set up 2FA for my personal GitHub account using a TOTP app on my Pebble watch. The actual crypto for the 2FA is done locally on the watch, no other device can spoof it, and GitHub get exactly zero feedback or information from this - other than the 2FA code that I type, of course. There's other ways to do 2FA - U2F is an upcoming standard and people have been using dongle-generated codes from RSA for years. Before making pronouncements that go against current best practices for end users, you really need to get a much better understanding of what you're talking about. Saying nonsense in a confidence voice is enough to convince people that your terrible advice is worth following, and could result in them having worse information security as a result.
snowwolf 10y ago
> What on earth are you on about? You can have the most secure/hardened email server on the planet but if I can change your mx record at your dns provider it will do you no good. And there are multiple attacks against DNS that don't require me to target your provider even (e.g. https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing) And once all your emails are being sent to me, I can own every account you've signed up for using that email (through reset password). And currently the only reliable defence against that is 2FA.