5 ms·

Curious, which apps seem to be affected? Anecdotally, I hadn't seen any issues on my phone this morning with anything asking for a password, but on my laptop I

by anmilo 12y ago

Curious, which apps seem to be affected? Anecdotally, I hadn't seen any issues on my phone this morning with anything asking for a password, but on my laptop I did see a login prompt when i woke it from sleep.

jgrahamc 12y ago
All non-Apple apps. So far have tested Twitter, Hipchat, BBC Weather, Wickr, Authy, Google Authenticator, YouTube and Citymapper.
- cmsj 12y ago
  weird, I can open Google Authenticator (the only app we have in common from that list) just fine
  - m_eiman 12y ago
    You probably have a signature check cached that's still valid.
  - anmilo 12y ago
    mine seem fine as well. I have a handful in common with that list. fingers crossed that they don't have to re-auth
- tombrossman 12y ago
  While this comes too late to help you right now, I recommend looking at running a 2FA app on your laptop or desktop like this - https://github.com/gbraad/gauth https://github.com/gbraad/gauth so that you are not in this situation again. Either that or grab a cheap Android handset and use it as a backup. The standard 2FA app on Android needs nothing more than occasional network connectivity to keep the clock in sync. You don't even need a Google account, the app is on FDroid. Cloudflare is huge and many of us rely on it, so I hope you can easily avoid this predicament in the future - good luck!
  - pilif 12y ago
    >I recommend looking at running a 2FA app on your laptop or desktop I very strongly recommend against doing this: If you do that, you are giving up a lot of security provided by that second factor as the malware you are using 2FA to protect against now also has access to the keys used to create the 2FA token.
    - tombrossman 12y ago
      This is a fair point of course, but running it on a second laptop is probably more secure than running it as a mobile app. You wouldn't run it on the same machine you are pushing production code out from, it could be a personal laptop with no access to company systems. I didn't make this point clear in my original comment though.
    - danieldk 12y ago
      If you have malware, it can also act as a proxy requesting your codes and forwarding them (e.g. to disable 2FA). 2FA protects against password theft. If your machine is compromised, it's over.
    - hobarrera 12y ago
      You're assuming the laptop has malware installed capable of pretty unrestricted access. At that point, all bets are off. It can just forward code, relay cookies, etc. 2FA protects against someone peeking at your keyboard, or reused passwords, not malware.
  - dunham 12y ago
    If you're really desperate: When I last checked, Google Authenticator's keychain entries were not marked "this device only", so they can be extracted from an encrypted backup using something like "iphone-dataprotection" tools.
  - mdaniel 12y ago
    the app is on FDroid I recently learned that there is an authenticator in f-droid, but not the authenticator, if one reads the notes at the top of the f-droid listing: https://f-droid.org/repository/browse/?fdid=com.google.android.apps.authenticator2 https://f-droid.org/repository/browse/?fdid=com.google.andro... I don't even know what they would want to stick in the Play store's authenticator above the already open sourced functionality.
deleted 12y ago
[deleted]
wolfhumble 12y ago
Some messages in the thread mentions: - iTunes Store - Mac App Store - Apple Support - Game Center (https://discussions.apple.com/thread/6868907?start=45&tstart=0 https://discussions.apple.com/thread/6868907?start=45&tstart...) Of these I have only tested "Mac App Store" and "Apple Support" and they don't seem to work. I could log into the Apple Store though.
briandear 12y ago
Apple TV is definitely affected as is iTunes Connect (at least for me.)
- deleted 12y ago
  [deleted]

by anmilo 12y ago

jgrahamc 12y ago

All non-Apple apps. So far have tested Twitter, Hipchat, BBC Weather, Wickr, Authy, Google Authenticator, YouTube and Citymapper.

cmsj 12y ago
weird, I can open Google Authenticator (the only app we have in common from that list) just fine
- m_eiman 12y ago
  You probably have a signature check cached that's still valid.
- anmilo 12y ago
  mine seem fine as well. I have a handful in common with that list. fingers crossed that they don't have to re-auth
tombrossman 12y ago
While this comes too late to help you right now, I recommend looking at running a 2FA app on your laptop or desktop like this - https://github.com/gbraad/gauth https://github.com/gbraad/gauth so that you are not in this situation again. Either that or grab a cheap Android handset and use it as a backup. The standard 2FA app on Android needs nothing more than occasional network connectivity to keep the clock in sync. You don't even need a Google account, the app is on FDroid. Cloudflare is huge and many of us rely on it, so I hope you can easily avoid this predicament in the future - good luck!
- pilif 12y ago
  >I recommend looking at running a 2FA app on your laptop or desktop I very strongly recommend against doing this: If you do that, you are giving up a lot of security provided by that second factor as the malware you are using 2FA to protect against now also has access to the keys used to create the 2FA token.
  - tombrossman 12y ago
    This is a fair point of course, but running it on a second laptop is probably more secure than running it as a mobile app. You wouldn't run it on the same machine you are pushing production code out from, it could be a personal laptop with no access to company systems. I didn't make this point clear in my original comment though.
  - danieldk 12y ago
    If you have malware, it can also act as a proxy requesting your codes and forwarding them (e.g. to disable 2FA). 2FA protects against password theft. If your machine is compromised, it's over.
  - hobarrera 12y ago
    You're assuming the laptop has malware installed capable of pretty unrestricted access. At that point, all bets are off. It can just forward code, relay cookies, etc. 2FA protects against someone peeking at your keyboard, or reused passwords, not malware.
- dunham 12y ago
  If you're really desperate: When I last checked, Google Authenticator's keychain entries were not marked "this device only", so they can be extracted from an encrypted backup using something like "iphone-dataprotection" tools.
- mdaniel 12y ago
  the app is on FDroid I recently learned that there is an authenticator in f-droid, but not the authenticator, if one reads the notes at the top of the f-droid listing: https://f-droid.org/repository/browse/?fdid=com.google.android.apps.authenticator2 https://f-droid.org/repository/browse/?fdid=com.google.andro... I don't even know what they would want to stick in the Play store's authenticator above the already open sourced functionality.

deleted 12y ago

[deleted]

wolfhumble 12y ago

Some messages in the thread mentions: - iTunes Store - Mac App Store - Apple Support - Game Center (https://discussions.apple.com/thread/6868907?start=45&tstart=0 https://discussions.apple.com/thread/6868907?start=45&tstart...) Of these I have only tested "Mac App Store" and "Apple Support" and they don't seem to work. I could log into the Apple Store though.

briandear 12y ago

Apple TV is definitely affected as is iTunes Connect (at least for me.)

deleted 12y ago
[deleted]