@77nn tutte dipendenze artificiose. I #2fa si possono sostituire con #OTP che girano anche su desktop. Anche dal famigerato #Google Authenticator poi estrarre le chiavi ed usarle su un OTP su #Linux. Io l'ho fatto.
Non tutti le banche obbligano l'uso di smartphone. Monte dei Paschi e Mediolanum, per esempio.
CIE manda tranquillamente SMS per il 2fa ma ad onor del vero non so se l'attivazione si possa fare con un #tontofonino
@Steutt @BucciaBuccia @quinta @informapirata
@77nn tutte dipendenze artificiose. I #2fa si possono sostituire con #OTP che girano anche su desktop. Anche dal famigerato #Google Authenticator poi estrarre le chiavi ed usarle su un OTP su #Linux. Io l'ho fatto.
Non tutti le banche obbligano l'uso di smartphone. Monte dei Paschi e Mediolanum, per esempio.
CIE manda tranquillamente SMS per il 2fa ma ad onor del vero non so se l'attivazione si possa fare con un #tontofonino
@Steutt @BucciaBuccia @quinta @informapirata
As my company is evaluation the use of #Cursor I'm playing around with it. First expression is mixed.
Scratching my own itch, I thought of implementing a software tool which checks which books of a #HumbleBundle book bundle I already own. Initially again my HumbleBundle library and additionally against my #BookWyrm.
I started in the planning mode.
Cursor listed some steps on how to accomplish the task and asked me which language I would like to use.
Stating that I would use whatever is best suited, Cursor picked #Python.
Being cheeky and with my preferred use in mind I asked if a browser plugin wouldn't be better suited
(imagine that, looking at a bundle, the books you own are automatically highlighted)
No chance. Cursor was determined to stick with Python!
Ok, lets generate the project
1/n
#Cursor generate roughly 1k lines of Python.
This included the (pseudo) code for querying #Bookwyrm. I would have preferred to generate this later (as a second step) But maybe it my mistake. I was prompting it wrong. I shouldn't have mentioned anything I didn't directly want.
Without looking at the Bookwyrm client code in detail, I doubt that it will work as my instance ( @realn2s@bookwyrm.social) require #2fa 🤷🏻
Checking the HumbleBundle client code I noticed several things
It contained a ton of normalization code. Of which I'm not sure if it is necessary (it might as well be, but I would leave it out for now. As it much harder to figure out that code isn't required but get executed nevertheless, than noticing that code is missing)
The authentication was done through a session cookie you had to extract form the browser. Cursor proposed to write it to an env file (that doesn't feel terrible secure 😬)
The Humble bundle client could either get the session cookie passed, or it would query the env 😬. I don't consider this good programming practice.
The code looks like it handles HumbleBundle games as well. This was requested and is additional code which shouldn't be there.
Reading through the code it looked about right. But it was too mich code, too much gold plating for me to be confident that the code really would be working.
Cursor provided no way to test the code apart from running it. And I'm not going to run it with my understanding.
On the positive side
I learned about the Click command line option "parsing" library
and about the dataclass decorator in #Python
Next step, let's try if Cursor can iteratively fixe some of my "issues"
2/n
Damn, #Yubikey migration almost complete...
It's like most people dependent on smartphones for #2FA logins everywhere, but much worse. Smartphone usually has one #authenticator app, everything visible in one place, Yubikeys have various modules inside and I use most of it for many different things.
Authenticator part here is the easiest one, at least I have nice list of accounts/services to display with one simple command. But I have to remember U2F enabled services myself... Or check how many files I encrypted with GPG, or where I could use ssh keys...
Oh, and I use also pam-u2f and have FIDO LUKS login configured...
Seriously, user could become even more dependent in more complex ways...
Why the hell these things don't just support firmware updates?!
Uffa #2fa #cambiopassword
Uffa #2fa #cambiopassword
Looks like somebody broke into #atari's #Sendgrid account and used it to send a bunch of phishing emails.
No explanation given for how; perhaps @zackwhittaker can wheedle it out of them.
Since it says here that they've "secured" the account, my guess is a bad password (or infostealer) + no #2FA. The most obvious explanation is usually the correct one.
Though I suppose a cracked Lastpass vault is also a possibility.
#infosec #breach
Hackers can steal 2FA codes and private messages from Android phones. The "Pixnapping" attack is a really clever piece of research. It shows that the theoretical wall between apps on your phone isn't as solid as we'd like to believe. By exploiting a GPU side channel, a malicious app with zero permissions can effectively screenshot other apps, one pixel at a time. It's a reminder that security is a stack, and a vulnerability at the hardware level can undermine everything built on top of it.
TL;DR
👾 A new attack called "Pixnapping" can read visual data from other apps on Android devices.
🔑 It exploits a GPU side-channel leak to steal sensitive info like 2FA codes and messages, pixel by pixel.
⚠️ The scary part: the malicious app required for the attack needs zero special permissions to be granted.
🧠 While complex to pull off, this is a serious proof of concept that challenges the core idea of OS app sandboxing.
https://arstechnica.com/security/2025/10/no-fix-yet-for-attack-that-lets-hackers-pluck-2fa-codes-from-android-phones/
#Android #Cybersecurity #SideChannelAttack #2FA #security #privacy #cloud #infosec
Hackers can steal 2FA codes and private messages from Android phones. The "Pixnapping" attack is a really clever piece of research. It shows that the theoretical wall between apps on your phone isn't as solid as we'd like to believe. By exploiting a GPU side channel, a malicious app with zero permissions can effectively screenshot other apps, one pixel at a time. It's a reminder that security is a stack, and a vulnerability at the hardware level can undermine everything built on top of it.
TL;DR
👾 A new attack called "Pixnapping" can read visual data from other apps on Android devices.
🔑 It exploits a GPU side-channel leak to steal sensitive info like 2FA codes and messages, pixel by pixel.
⚠️ The scary part: the malicious app required for the attack needs zero special permissions to be granted.
🧠 While complex to pull off, this is a serious proof of concept that challenges the core idea of OS app sandboxing.
https://arstechnica.com/security/2025/10/no-fix-yet-for-attack-that-lets-hackers-pluck-2fa-codes-from-android-phones/
#Android #Cybersecurity #SideChannelAttack #2FA #security #privacy #cloud #infosec
Hackers can steal 2FA codes and private messages from Android phones
> Android devices are vulnerable to a new attack that can covertly steal 2FA codes, location timelines, and other private data in less than 30 seconds.
> The new attack, named Pixnapping by the team of academic researchers who devised it, requires a victim to first install a malicious app on an Android phone or tablet.
> The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen. Pixnapping has been demonstrated on Google Pixel phones and the Samsung Galaxy S25 phone and likely could be modified to work on other models with additional work. Google released mitigations last month, but the researchers said a modified version of the attack works even when the update is installed.
https://arstechnica.com/security/2025/10/no-fix-yet-for-attack-that-lets-hackers-pluck-2fa-codes-from-android-phones/ #Android #Cybersecurity #InfoSec #2FA #Privacy #Pixnapping #GooglePixel #Samsung #MobileSecurity #DataBreach #ZeroDay #TechNews #Hacking
Hackers can steal 2FA codes and private messages from Android phones
> Android devices are vulnerable to a new attack that can covertly steal 2FA codes, location timelines, and other private data in less than 30 seconds.
> The new attack, named Pixnapping by the team of academic researchers who devised it, requires a victim to first install a malicious app on an Android phone or tablet.
> The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen. Pixnapping has been demonstrated on Google Pixel phones and the Samsung Galaxy S25 phone and likely could be modified to work on other models with additional work. Google released mitigations last month, but the researchers said a modified version of the attack works even when the update is installed.
https://arstechnica.com/security/2025/10/no-fix-yet-for-attack-that-lets-hackers-pluck-2fa-codes-from-android-phones/ #Android #Cybersecurity #InfoSec #2FA #Privacy #Pixnapping #GooglePixel #Samsung #MobileSecurity #DataBreach #ZeroDay #TechNews #Hacking
Hey @bitwarden you are being misleading and it's making us sad.
Your website currently has a misleading link (and its affecting us being able to recommend ur tools).
Your dedicated Authentor app on the "Bitwarden Authenticator' page, has a Download it today button at the top of the page > That SHOULD take folks to the Authenticator download links (like at the bottom of the page), but instead it takes people to download the FULL Bitwarden Password Manager software.
Currently we're having to recommend folks use an alternative service as this is coming across as sneaky and dirty tactics. Really hoping it was unintentional. Regardless, pls fix so that this link takes ppl to download the tool they are expecting.
We were hoping to recommend ur service at our upcoming Digital Lounges, but we only endorse the most ethical open providers and stuff like this is the stuff the community notices.
#BItwarden #AuthenticatorApp #MFA #2FA #Authentication #Misleading #MisleadingCopy #Marketing #BigTech #FOSS
Warum Zwei-Faktor-Authentifizierung wichtig ist... 😁 #2fa
Warum Zwei-Faktor-Authentifizierung wichtig ist... 😁 #2fa
Yet another security problem plaguing #SonicWall customers.
The #Akira #ransomware gang have found a way to override the multifactor authentication in #SonicWall SSL VPN appliances. These scrotes appear to be able to move laterally from the VPN boxes to deploy ransomware.
It’s worrying that they’ve broken SonicWall’s #2FA. In #SBBlogwatch, we hear customers’ anger.
Yet another security problem plaguing #SonicWall customers.
The #Akira #ransomware gang have found a way to override the multifactor authentication in #SonicWall SSL VPN appliances. These scrotes appear to be able to move laterally from the VPN boxes to deploy ransomware.
It’s worrying that they’ve broken SonicWall’s #2FA. In #SBBlogwatch, we hear customers’ anger.
🆕 blog! “Some minor bugs in Proton's new Authenticator app”
I maintain a a test-suite for TOTP codes. It contains a bunch of codes which adhere to the specification, some of which stretch it to breaking point, and some that are completely invalid. These codes are a good starting point for checking whether a 2FA / MFA app works correctly.
Proton …
👀 Read more: https://shkspr.mobi/blog/2025/08/some-minor-bugs-in-protons-new-authenticator-app/
⸻
#2fa#CyberSecurity#MFA#Proton #totp
🆕 blog! “Some minor bugs in Proton's new Authenticator app”
I maintain a a test-suite for TOTP codes. It contains a bunch of codes which adhere to the specification, some of which stretch it to breaking point, and some that are completely invalid. These codes are a good starting point for checking whether a 2FA / MFA app works correctly.
Proton …
👀 Read more: https://shkspr.mobi/blog/2025/08/some-minor-bugs-in-protons-new-authenticator-app/
⸻
#2fa#CyberSecurity#MFA#Proton #totp