#otp

Vultr must have the most stupid way of OTP management I've seen in a long while. You cannot delete an OTP token on your account if you do not have access to the OTP token. Let that sink in. If you try to delete a token from your Vultr account, you need to enter the OTP value of that token to be allowed to remove it. Then consider a scenario where you've lost access to a hardware token, or like if your mobile holding the token has been stolen. The same goes for backup codes. This is quite a huge security fail. Of course, it could be I'm just stupid and haven't understood the account management panel. #vultr #infosec #otp #totp #fail (Luckily, I was just unfortunate and deleted the Vultr OTP in my OTP manager - so the risk is manageable + I'm moving away from Vultr, now definitely completely)

Vultr must have the most stupid way of OTP management I've seen in a long while. You cannot delete an OTP token on your account if you do not have access to the OTP token. Let that sink in. If you try to delete a token from your account management, you need to enter the OTP value of that token to be allowed to remove it. Then consider a scenario where you've lost access to a hardware token, or like if your mobile holding the token has been stolen. The same goes for backup codes. This is quite a huge security fail. Of course, it could be I'm just stupid and haven't understood the account management panel. #vultr #infosec #otp #totp #fail (Luckily, I was just unfortunate and deleted the Vultr OTP in my OTP manager - so the risk is manageable + I'm moving away from Vultr, now definitely completely)

Vultr must have the most stupid way of OTP management I've seen in a long while. You cannot delete an OTP token on your account you do not have access to Let that sink in. If you try to delete a token from your account management, you need to enter the OTP value of that token to be allowed to remove it. Then consider a scenario where you've lost access to a hardware token, or like if your mobile holding the token has been stolen. The same goes for backup codes. This is quite a huge security fail. Of course, it could be I'm just stupid and haven't understood the account management panel. #vultr #infosec #otp #totp #fail (Luckily, I was just unfortunate and deleted the Vultr OTP in my OTP manager - so the risk is manageable + I'm moving away from Vultr, now definitely completely)

Vultr must have the most stupid way of OTP management I've seen in a long while. You cannot delete an OTP token you do not have access to Let that sink in. If you try to delete a token, you need to enter the OTP value of that token to be allowed to remove it. Then consider a scenario where you've lost access to a hardware token, or like if your mobile holding the token has been stolen. This is a huge security fail. Of course, it could be I'm just stupid and haven't understood the account management panel. #vultr #infosec #otp #totp #fail (Luckily, I was just unfortunate and deleted the Vultr OTP in my OTP manager - so the risk is manageable + I'm moving away from Vultr, now definitely completely)

This is the part of 2FA/TOTP that many people don’t realize: Your phone isn’t receiving the 6-digit code from the server. Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐 It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code. At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter. Same secret + same time counter + same algorithm = same result. That’s why your authenticator app can generate the correct code without receiving it from the server. It’s a simple idea, but a brilliant application of cryptography. You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time. And here’s another important point: The algorithm doesn’t need to be secret. TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key. So: 🧮 Algorithm/math: Can be publicly known. 🔑 Secret key: Must remain private. Never share it. ⏱️ Time: Isn’t secret. 🔐 Security: Comes from protecting the secret key, not from hiding the algorithm. That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key. #2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

I am always afraid this will happen. Thanks @FaviFake for the video #OTP #Paste

@Mae@is.badat.dev so can I finally mandate PGP-based 2FA (like on dread)? Cuz I won't install a garbage app that won't run on my devices anyway and I won't have TOTP / HOTP available all the time… #PGO #2FA #App #Enshittification #OTP #TOTP #HOTP

ulimit -l 98304 sources man ulimit (3) man otpclient (1) https://github.com/paolostivanin/OTPClient/wiki/Secure-Memory-Limitations#2FA #MFA #ulimit #OTP #secure #ram #limit #programming #OpenSource