PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Getting 2FA Right in 2019

blog.trailofbits.com | blog | #pypi | #authentication | #account-security | #2fa | #webauthn | #totp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

With PyPI now supporting TOTP and WebAuthn, Trail of Bits shares lessons from adding 2FA to Warehouse: second factors must be something you have or are, SMS is broken, and WebAuthn beats TOTP.
Published
Collected

Related coverage

blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · blog.trailofbits.com
Enabling Two-Factor Authentication (2FA) for Apple ID and DropBox
A guide to enabling SMS-based two-factor authentication on Apple ID and Dropbox accounts, prompted by the 2014 credential compromises; explains how a second factor defeats password-based attacks.
blog · about.gitlab.com
Passkeys now available for passwordless sign-in and 2FA on GitLab
GitLab now supports passkeys for passwordless sign-in and phishing-resistant 2FA using WebAuthn, keeping private keys on-device. Works across major browsers, iOS 16+/Android 9+, and FIDO2 keys.
blog · bugcrowd.com
Platform Updates: Portfolio Accounts and Security Settings
Bugcrowd adds Portfolio Accounts linking GitHub, StackOverflow, and PentesterLab profiles to improve CrowdMatch recommendations, plus new Security and Privacy tabs with 2FA and session visibility.
blog · bugcrowd.com
Platform Update: 2FA Backup codes
Bugcrowd now lets researchers generate one-time 2FA backup codes to restore account access after losing their authentication device, eliminating support tickets. Some programs require enabling 2FA.
blog · aikido.dev
npm now freezes high-impact accounts after risky account changes
npm now puts high-impact accounts into a 72-hour read-only freeze after sensitive changes like email swaps or 2FA recovery-code use, alerting the previous email while installs keep working.
Back