⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️ @falken@social.cleverlibre.org

Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.

TL;DR: Don't turn it on.

The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.

We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.

Why is this bad?

Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access ....

#Privacy #Cybersecurity #InfoSec #2FA #Google #Security

@stux Any word on why mstdn.social blocked qoto recently.. they added the following reasaon, which makes no sense, what is going on over there:

"Objects to the fediblock process and claims that it should be put to a "democratic vote" weighted by instance size, and his just happens to be the largest."

Your mods going rogue over there or something?

@Pat @trinsec @khird

@trivikram @macdonst @brianleroux @schizanon here is the bug report: https://github.com/aws/aws-sdk-js/issues/4401
Can confirm this is specific and isolated only to importing `aws-sdk`; importing other modules continues to work fine. Requiring continues to work fine, as does v3 import/require. Pls lmk if you have any questions!

Oh good, I successfully switched off emergency alerts on all my mobile devices.