CubitOom

joined 1 year ago
[–] CubitOom@infosec.pub 1 points 9 months ago (2 children)

I'm just using my password manager in place of the authenticator app.

So rather than using an app like Google authenticator or Authy to see what the new random sequence is for the MFA, my password manager stores that QR as a string and will display the same random sequence that a normal MFA app would.

They key difference is that my MFA is synced across any device that I have configured my password manager on using the same cryptographic keys and version control history.

So if my phone is dead, lost, or stolen, I can still access my banking account via MFA as normal.

I suppose it brings up the idea of what a "factor" is in how it's used for MFA. If a factor is supposed to be a different device, a different app on the same device as your password manager, or just a different passphrase that's constantly changing.

[–] CubitOom@infosec.pub 1 points 9 months ago

Thank you, these are all great points.

[–] CubitOom@infosec.pub 3 points 9 months ago (2 children)

I am not an expert, but I try to be pragmatic. Here's what socalgas.com says about the topic.

You're right that natural gas is methane and that leaks are bad. However I think a nuanced view is important here for a few reasons.

  • Many developed countries have the infrastructure and workforce in place to not just safely deliver methane to buildings as an energy source but also to correct leaks.

  • Methane can be produced via a variety of sources both at a large and small scale. I've toyed with the idea of making a black soldier fly larvae farm and methane would be a by product

  • Gas tanks to hold methane have maximum a lifespan of 10 years. However many other methods of storing potential energy have a much shorter maximum lifespan, making methane a decent backup energy source in cases of emergency.

I don't know how good the energy conversion rate of burning methane is but I would be surprised if it is low.

Personally I think we should leverage every option, especially the lower hanging fruit before dismissing these options as being not ideal when the alternative is continuing to do worse.

[–] CubitOom@infosec.pub 2 points 9 months ago (3 children)

How does Microsoft's implementation work?

Is it possible to log into windows without a Microsoft account using that method?

[–] CubitOom@infosec.pub 2 points 9 months ago (4 children)

One of the biggest issues with 2fa is that normally it's either an easily spoofable phone/email or an app locked to a device.

This is why I use a password manager (pass) that is synced across all of my devices (via a private self hosted git for version control) that I can send 2fa QR codes to cameraless devices via screenshots using zbarimg and have every device capable of 2fa verification with the pass-otp extension.

I know this setup is a bit complicated as just dealing with git or importing a gpg key would give most people I know sense of existential dread. I am curious to see what others use for similar functionality.

[–] CubitOom@infosec.pub 20 points 9 months ago

Asking someone to quit emacs when they never tried before is a great method to generate random strings for a secure password.

[–] CubitOom@infosec.pub 10 points 9 months ago (1 children)

You could always use emacs with evil-mode to have vim key bindings

[–] CubitOom@infosec.pub 4 points 9 months ago
[–] CubitOom@infosec.pub 1 points 10 months ago* (last edited 10 months ago)

I'm also using the lift. Although I don't do too many shooters, it did get me through cyberpunk 2077, elden ring, and armored core VI very well.

I'll also note that I have had no issues with Linux drivers on Arch.

[–] CubitOom@infosec.pub 6 points 10 months ago

I offer a 6th option: Mike Wazowski

[–] CubitOom@infosec.pub 4 points 10 months ago (1 children)

Did anyone else just hear the twin peaks theme music in their heads?

[–] CubitOom@infosec.pub 20 points 10 months ago* (last edited 10 months ago) (5 children)

I make my own tofo, with help from my soy milk machine which is composed mostly of...wait let me check...plastic and acrylic...damn.

view more: ‹ prev next ›