Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.
TL;DR: Don't turn it on.
The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.
We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.
Why is this bad?
Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access ....
@freemo If it's built on the same protocol, how does it distinguish itself?
@kevkev I bet there's a database of expiring accounts somewhere with their follower count that's allowing unscrupulous individuals to snatch up abandoned usernames for their own purposes.
Wouldn't surprise me at all to learn that Musk's broken product is giving them the prior account's followers.
@pieist Then I still would have left. Beyond his support for right-wing trolls, he's an odious attention hog forcing his juvenile and desperate content on his captive audience. That would have been enough for me to leave.
That said, would it be so awful if people left because of the larger content shift on the platform? Voting with one's feet is a quintessential lever in the marketplace of ideas.
@pieist In that hypothetical, would Musk be one of the people I liked? Because that's a difficult hypothetical to evaluate.
@shoq Yes, from what I understand of how Mastodon handles its decentralized infrastructure, more users/servers means exponentially more data, which means slower load times and more money spent by server owners.
In theory, you'd like the decentralized servers to balance the load. But instead, Mastodon is designed to store inboxes locally on each server, so each server has to store not only its own data, but also the data that other servers have pushed to it (i.e. the feeds you subscribe to). It's redundant and expensive, but the reason they did it (presumably) is because content from a server won't entirely vanish if that server vanishes.
Sometimes you come across an article or documentary that you were not expecting to hook you in, that manages to combine a whole bunch of interesting issues in one amazing narrative.
This, from @ryanhoulihan is one of those, and covers AI, deep fakes, the music industry, culture and Britney Spears.
If you remember the Black Mirror / Miley Cyrus episode from a few years back, strap in, this is an even wilder ride.
https://mastodon.social/@ryanhoulihan/110135460306229895
@shoq The jealousy and desperation is just dripping off that tweet. He's going to date a man next week just for likes and retweets isn't he?
@Westdragon @RollingStone There exist people between the two ends of the spectrum.
More importantly, we don't need any more preaching to the choir.
@RollingStone You guys do realize that using terms like "Dark Brandon" severely undermines any point you make, right?
It's like a subtle scream, telling people "don't bother reading this unless you already agree with the premise".
@acjay ...like a battered wife returning to her abusive spouse yet again...
Friendly message to all of #gamedev; If you haven't bookmarked this site yet do it now.
@saint11 Consider yourself lucky. At least you haven't locked yourself into a pattern that doesn't universally fit. I've found myself hamstrung in the past by thinking there was a "right way".
@acjay Yeah, but do those features outweigh the weak point of being owned by Dorsey?
@worldsendless @icedquinn Then yeah, it was probably just on some list registry somewhere.
@icedquinn @worldsendless Probably more than one, yeah. It wouldn't make sense to register a bunch of them with an area code tied to a physical location.
@worldsendless @icedquinn The range of possible numbers they can offer is static, yes.
BREAKING: Tucker Carlson Is No Longer a Fox News Host https://www.rollingstone.com/politics/politics-news/tucker-carlson-fox-news-end-relationship-1234722551/
Software engineering contractor/consultant in Florida specializing in .NET C# #WebDev, plus #Indie #GameDev in #MonoGame, #Stride, and #Godot.
I like complex simulations and enjoy writing procedural generation algorithms for fun.
#Pilot in training. Burgeoning fan of #Aviation in general.
Fan of #1A jurisprudence and the kind of #FreeSpeech that applies to everyone equally.
Pro-Democracy. Pro-Rights. Pro-Freedom. In that order.
He/Him 🏳🌈
High risk of rants, especially with the lack of character limit.