5 ms·
These stories are starting to scare me... I've already started using 1Password but I'm now considering closed some accounts and calling some of these services
by philliphaydon 13y ago
These stories are starting to scare me...
I've already started using 1Password but I'm now considering closed some accounts and calling some of these services to ensure they never give out my information for password resets and such... Scary stuff...
- robin_reala 13y agoIt’s worth setting up two-factor authentication on any service that supports it: Google, Facebook and Github spring to mind.
- philliphaydon 13y agoI've got it setup on facebook and google, didn't know GitHub has it.
- philliphaydon 13y agoAwesome! Github setup! Thanks.
- benjamta 13y agoAnd AWS! As the article said he got lucky that the attacker didn't twig that there was an AWS account associated with that amazon.com login. You should be using two-factor authentication for all your AWS accounts, especially the 'root' account that's tied to your regular Amazon.com login (I've always though this is a bit odd). You should also never use that root account and set up IAM accounts for yourself and any other user (which also use 2FA).
- eik3_de 13y agoDropbox and app.net also do 2FA. If the service you're using doesn't support it, ask them to implement it. If enough people did it..
- girvo 13y agoI'm currently building a framework agnostic Authentication module for PHP/Composer, that has 2FA baked in. I want to give everyone who's building web apps in PHP no excuse for not having it. It's painful, but worth it IMO.
- prophet_ 13y agoAnd I thought that dropbox had already lost their reputation with pretty much everyone around since those massive security flaws exposed a while back. Silly me.
- exhilaration 13y agoSo does Namecheap.
- andyjohnson0 13y agoI'd like to enable two factor auth on my twitter account, but I'm put-off by their SMS-based implementation. Does anyone know if they have plans to support TOTP, like Google, GitHub, etc?
- deleted 13y ago[deleted]
- brown9-2 13y agoIf you have the Twitter app on your smartphone, you can get notifications through it. I have 2FA for Twitter but do not receive SMS messages.
- andyjohnson0 13y agoThanks, I didn't know that! That might be good enough, as I quite often have no phone signal (and therefore no SMS) but still have net connectivity via wifi. I'd still prefer the TOTP approach though because it doesn't require any connectivity on the phone.
- giantrobothead 13y agoDefinitely. While it's not a perfect solution, it provides an extra layer of protection for your accounts by making an extra hurdle for any attacker to clear. Needing two components to access/change your accounts is elegant and effective. Pay-as-you-go phones are advisable to use for two factor verification, as they are affordable and could be used only for this purpose. Don't hand out the number and you've got a nice disposable tool for protecting your accounts.
- Moru 13y agoMany providers shuts down the account if you don't use it for calling at least once per year. Some close it down if you don't fill up the cachpool with money every 6-12 months.
- jtheory 13y agoRight, pay-as-you-go phones are annoying that way, if you aren't actually using them. I've lost a few phone numbers because I didn't remember to top-up a phone I wanted for rare uses and/or only incoming calls.
- giantrobothead 13y agoAh yes, I hadn't thought of that. Probably because I have around two years worth of service built up on mine.