#Two Factor Authentication

[smellslikebot]

heads up for anyone using Authy for 2FA

authy's desktop app is being discontinued on March 19, 2024-- apparently moved up from an initially-planned date of August 19 for some reason

i think authy gets recommended a lot specifically for having a desktop option, and the EOL announcement email ended up in my spam folder, so i figured i should try to spread the word.

as far as potential alternatives go, so far i've found ente Authenticator, which has apps for Android and iOS and apparently allows you to access your 2FA codes on web as well. there's also 2FAS, which is open source and has a browser extension, but it sounds like the extension still requires your phone and they recently launched an NFT project(???) so... ymmv!

(of course there are plenty of good mobile-only authenticators, but again, the appeal of authy was that it enabled you to access your keys even if you lost your smartphone or didn't have one in the first place)

[spacefucksmeup]

honest to god id give away my whole identity to never use two factor authentication ever again. I don't care! the security is not worth it!

[porgthespacepenguin]

1. How to setup 2FA on your accounts

As some of you may know, my friend @why-its-kai's Discord account was taken over this morning by a scammer.

The scam they used was this one, or close enough; but anyway, the exact specifics don't matter.

What matters is, it can happen to you. It can happen to anyone.

The good news is, you can learn how to protect yourself. Making some small changes can already improve your online security by leaps and bounds.

I made a series of 3 posts covering the basics:

How to setup 2FA on your accounts (you are here!)

How to spot a scam

How to set up a password manager.

Protect yourself with 2FA

Two-factor authentication, or 2FA, isn't a silver bullet -- but it exponentially increases your online safety by adding an extra step to the login process that a hacker/scammer does not have access to.

Every account that you care about (and even those you don't) should have some form of 2FA enabled.

Especially email -- should your email become compromised, this can become a catastrophe.

(For websites that don't support 2FA, use a burner email!)

What 2FA should I use?

2FA can take many forms, from the highly convenient (SMS, email) to the highly secure (security keys), but one thing is certain:

Any form of 2FA is better than nothing.

The simplest forms of 2FA are phone number or email. While these are very easy to use, they are unfortunately not very secure.

Still, I repeat: despite their flaws, these forms of 2FA are absolutely, 100% better than not having any 2FA at all.

On the other end of the spectrum, security keys (like for example a Yubikey) are extremely secure, but they cost money and are a bit of a hassle at time. I use them, but for most people, it's overkill.

What you want is an authenticator app.

Important

A note, before we go on…

If you enable multiple forms of 2FA, how secure your account is will depend on your weakest link.

For example, if you enable SMS authentication AND register a security key, your account will only be as safe as the SMS authentication. The security key is essentially useless.

In other words, the least secure form of 2FA you add determines the overall security of your account.

Sometimes, less is more!

Authenticator Apps

First, choose a free, reputable authenticator. Google Authenticator is a good choice. So are Aegis Authenticator or Microsoft Authenticator.

For simplicity, we'll go with Google Authenticator; the process is rather similar for most authenticators.

First, download the app from your app store and install it on your phone.

Enrolling Gmail into GA

Securing your email should be your number 1 priority, so let's enroll a Google account to Google Authenticator.

Let's enable two-step verification first.

Phone number is better than nothing, but not very safe (SMS verification can be spoofed), so let's click on "Add authenticator app".

Click on "Set up authenticator". Google will generate a QR-code.

Next, go back to your phone and click on the little multicolored cross. It will bring up a menu; click on "scan a QR code".

Go ahead and scan the QR code.

Congratulations, you have enrolled your Google account!

Now, whenever you are asked for a 2FA code, just open the app and copy/paste it.

Note: the codes are stored locally on your phone.

Enabling 2FA on Discord

The process is fairly similar. Go to Settings > My Account:

Click on "Enable Authenticator App". You will be prompted for your password. Enter it.

Download Google Authenticator if you haven't already. Scan the QR code as described above.

Do take the time to download your backup codes as well!

As explained above, I personally do not recommend setting up SMS authentication here, since authenticator apps are supported, as this weakens the overall security of your account for little benefit.

Stay tuned for parts 2 and 3!

If you have any questions, feel free to PM me.

[foobars-cool-car]

i should write an essay about adhd and 2factor authentication/online textbooks

[bluesky-out-of-context]

[ezekiel13]

Imma be so real my two factor authentication is so funny because why do you want me to open YouTube to verify my college account.

Like I will. I think it’s fucking hilarious. It’s not the college it’s google- I think I accidentally set it up this way? But. This is so funny. Yeah I’ll open YouTube. Funny.

[mentalisttraceur-software]

(deep long sigh)

Reminder that when you implement 2FA setup, you should let people optionally get the same code that the QR image contains as plain text.

This allows, for example, setting up 2FA through a browser on the same phone that contains the authenticator app.

[author-a-holmes]

PSA To My Newsletter Subscribers

My newsletter is going to be late this month. This is because I am a certified idiot, and when I updated my phone number last month I thought I'd updated all the websites that required 2-Factor-Authentication.

Turns out, I forgot to update my WEBSITE. That I need to update, so I can link to a post in my Newsletter.

All said and done, I have to phone my website provider in the morning to try and prove who I am so I can get back into it again.

Then, if I can do that, I need to update the website. A Worst case scenario will be me having to speedily rebuild my website. Let's hope it's not a worst case scenario, eh?

Then, I'll be able to send out my Newsletter.

Some deity out there better give me strength for the rest of 2024, I swear...

[auadhdwildcards]

I can't log in without my two factor idetification code. But i can't log in to get my two factor identification code because it requires my two factor identification code.

Can't deactivate my two factor identification system without *drumroll please* the two factor identification code

[gallium-spoon]

Does two factor authentication actually, like, work? Am I actually less likely to get hacked or have my info stolen? Because I find two factor authentication to be really annoying and if it's nothing but security theater I'm gonna be one step closer to just walking into the woods

[muck-raker]

i know tfa is technically more secure but as someone who often doesn't have a phone it pisses me the fuck off

[locallysourcedtgirl]

Two-Factor Authentication is fhe worst tragedy to befall mankind.

grug hate two factor authentication. first grug have to remember password. then grug have to point out which cave painting has birds. now they want grug to hunt and gather new thing called numbers. grug won’t do it grug miss the bird paintings grug was getting pretty good at birds.

[4leafchlovers]

[b3aches]

Friendly reminder, if 2 factor authentication is available for a service, enable it. It's saved my butt several times.