74
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Sep 2023
74 points (97.4% liked)
Privacy
31601 readers
344 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Nowadays many services just force MFA on you in some way, and stuff like SMS or email verification is shitty, insecure and inconvenient. TOTP is then the next best thing, and having it integrated with a password manager is fine as long as you are aware of the risks.
mfa is good tho. i think its almost good its forced on normies. sms/email 2fa is garbage however, and google authenticator is very bad for privacy. for most people (assuming you have a phone), is it really that much to have a separate password-locked 2fa totp app? they exist for both phone and desktop, and can be synced (although personally i cant see that being a good idea). totp is basically a hidden password hashed with the current time, so if the hidden password is leaked it can be replicated at any time. if your main computer gets compromised or keylogged, then accessing one 6-digit code is worthless unless used in the next 30s, unlike the totp secrets
Sure, but ideally there should be an option to opt out for most things. Sometimes you get forced into it for the dumbest stuff.
And, like, don't forget that everyone's use case is different. For most people, Google account is really important. But I might use it as a burner account and not care about its security almost at all. Then MFA is only annoying.
I use PC for most of what I do (both work and leisure). There's a major difference between having TOTP autofilled and having to find my phone, pick it up, unlock it, find the authenticator app, click/find the correct authenticator, then typing in the code.
Again, depends on the account, but for the vast majority of my accounts it's complete overkill.
Doesn't help that many providers don't properly remember devices/logins. If I had to sign into a given account once a year I wouldn't care much. But when it's monthly or more (for many, many accounts), and half of them don't even remember the device and ask for OTP every time, it truly is a pain.
Realistically if my main computer gets compromised I'm royally fucked either way. I try to be safe in general, know what I'm doing for the most part (definitely more than your average user, though that's probably true about literally everyone on Lemmy) and in like 20 years since I had access to a computer I never had an issue, so I'm probably doing something right (and I used to do way, way dumber stuff on much less secure systems than one has today).
But yeah, you're right I probably shouldn't have OTP in my password manager at least for my primary email. I'm sure I'll get to fix that someday...
i agree with your point about different use cases.