PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Platform Update: 2FA Backup codes

bugcrowd.com | blog | #authentication | #bugcrowd | #account-security | #platform-update | #2fa | #backup-codes
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd now lets researchers generate one-time 2FA backup codes to restore account access after losing their authentication device, eliminating support tickets. Some programs require enabling 2FA.
Published
Collected

Related coverage

blog · bugcrowd.com
Platform Updates: Portfolio Accounts and Security Settings
Bugcrowd adds Portfolio Accounts linking GitHub, StackOverflow, and PentesterLab profiles to improve CrowdMatch recommendations, plus new Security and Privacy tabs with 2FA and session visibility.
blog · blog.trailofbits.com
Getting 2FA Right in 2019
With PyPI now supporting TOTP and WebAuthn, Trail of Bits shares lessons from adding 2FA to Warehouse: second factors must be something you have or are, SMS is broken, and WebAuthn beats TOTP.
blog · blog.trailofbits.com
Enabling Two-Factor Authentication (2FA) for Apple ID and DropBox
A guide to enabling SMS-based two-factor authentication on Apple ID and Dropbox accounts, prompted by the 2014 credential compromises; explains how a second factor defeats password-based attacks.
blog · aikido.dev
npm now freezes high-impact accounts after risky account changes
npm now puts high-impact accounts into a 72-hour read-only freeze after sensitive changes like email swaps or 2FA recovery-code use, alerting the previous email while installs keep working.
blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Targeting RSA Emergency Access Tokencodes for Fun and Profit
Shows how an attacker with domain credentials can request an RSA Emergency Access Tokencode from the self-service console and brute force the numeric PIN, turning recovery features into a 2FA bypass.
Back