4 ms·
The highest profile target is your personal email account, because that's generally the account that can reset the others. Does your email have support for U2F
by idlewords 9y ago
The highest profile target is your personal email account, because that's generally the account that can reset the others. Does your email have support for U2F or at least an authenticator app?
- technion 9y agoI'm running Office 365 with the only thing is supports - Microsoft's app. Which is not infallible: https://lolware.net/2017/08/01/capturing-mfa-logons.html https://lolware.net/2017/08/01/capturing-mfa-logons.html Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here.
- ownagefool 9y agoLast time I used Office 365 you could disable the push requirment when configuring the auth app, that would then allow you to use alternatives. I used freeotp with my o365. :)
- ihattendorf 9y agoYep, just set it up a couple days ago. Supports Google Authenticator/Authy/etc.
- tokenizerrr 9y ago> Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here. Do you check this mailbox frequently? If not, won't you miss important communication?
- 0xffff2 9y agoI'm also using Office 365, but I use the same TOTP app that I use for every other 2-factor service I use...
- icebraining 9y agoI have my email protected by an SSH key plus TOTP (using the cool Google Authenticator PAM module), but I just realized I haven't enabled 2FA on the VPS control panel, so everything is protected only by a single password. sigh
- PappaPatat 9y agoWhen you are hosting your email / whatever on a VPS... access to your system is possible via a whole bunch of "not 2FA enabled" routes. I would treat that as the least trusted storage available.
- icebraining 9y agoYeah, maybe. My "threat model" is mostly drive-by automated attacks (like malware stealing my not-very-protected SSH keys) or overly broad warrants, not people specifically targeting me.