Email or username:

Password:

Forgot your password?
Jerry Bell :verified_paw: :donor: :verified_dragon: :rebelverified:​'s posts Post Back to profile
Jerry Bell :verified_paw: :donor: :verified_dragon: :rebelverified:​

This message for everyone on the fediverse:

First, please ensure you go into your account settings and enable two/multi factor authentication. No, I mean do it right now. I’ll wait till you’re done.

…

…

Ok, thank you.

Now, if you are the admin of a mastodon instance, please go upgrade to 4.0.2 ASAP.

Background: portswigger.net/research/steal

15 Nov 2022 at 14:17 | Open on infosec.exchange
39 comments
DELETED
Maya :v_gay: :v_trans:

@jerry @david we up to date on tech.lgbt yet?

Seems there was the ability for credential stealing.

15 Nov 2022 at 14:21 | Open on tech.lgbt
a pup of coffee :v_agender: :bowie: ☕

@AtomicMaya @jerry Thank you for sharing. I scheduled the update for tomorrow, but based on this info I'm going to run the upgrade now after a backup

15 Nov 2022 at 14:26 | Open on tech.lgbt
Aaron de Montmorency

@jerry beat me to it. I mean, if someone in the infosec community didn't immediately set up MFA, that's a paddlin'.

15 Nov 2022 at 14:24 | Open on infosec.exchange
human. :ve:
Reverse Module :kafeneio:

@jerry Can someone tell me where 2FA resides cause I can't seem to fin it in the Settings.

15 Nov 2022 at 14:29 | Open on kafeneio.social
Reverse Module :kafeneio:

@jerry It's under Account, I'm just blind. XD

15 Nov 2022 at 14:32 | Open on kafeneio.social
yoshir

@ReverseModule
click on the gear, then on account, then on confirmation

15 Nov 2022 at 14:59 | Open on lor.sh
Maikel :bash: 🇪🇺
aetios ▶️ kwsp
@jerry No 2FA on akkoma I believe, which is too bad. Interesting vulnerability though. Good thing I've long stopped using chrome autofill for my passwords. I believe more of these vulnerabilities will be found in the future. They are part of the growing pains of a hobby-size platform growing up.
15 Nov 2022 at 14:33 | Open on ak.kawen.space
Simon :donor:

@jerry I give up, I can't find the settings for it :-(

15 Nov 2022 at 14:35 | Open on infosec.exchange
Jerry Bell :verified_paw: :donor: :verified_dragon: :rebelverified:​

@staustellsimon you have to do it through the web interface- most mobile apps don’t expose that setting

15 Nov 2022 at 14:40 | Open on infosec.exchange
Simon :donor:

@jerry yeah, I am, gone to account, nothing about 2fa that I can see

15 Nov 2022 at 14:43 | Open on infosec.exchange
Simon Zerafa :donor: :verified:

@jerry @staustellsimon

Probably best to set 2FA/SA up via web on a PC. You'll need your phone free for the setup anyway 😉🤷‍♂️

15 Nov 2022 at 15:18 | Open on infosec.exchange
ChickenPwny

@jerry i knew the img had something bad with it xD

15 Nov 2022 at 14:35 | Open on infosec.exchange
🕵CatSalad🐈🥗〰️⁠ℹ️Ꝋℂ

@jerry
I always setup 2FA on every site/account I can by default, but yikes. Signal boosting this #vulnerabilty for awareness

15 Nov 2022 at 14:36 | Open on ioc.exchange
Ash K
Benny Powers
KayleeSerenada

@jerry excellent work, thank you for publishing this!!

15 Nov 2022 at 14:42 | Open on ioc.exchange
Carlos Melero

@jerry seems MFA is mitigating the issue of having a password manager autofilling credentials. *Disable autofill*

15 Nov 2022 at 14:44 | Open on ioc.exchange
Charles Gillogly

@carlosmelero @jerry Thankfully that is always my default setup. It's always a little less convenient, but I've never trusted autofill because of stuff like this.

15 Nov 2022 at 14:56 | Open on mastodon.social
May 🌲
@jerry oh thats good, im not retarded enough to use browser autofill
15 Nov 2022 at 14:45 | Open on pl.serialmay.link
Jess👾
Simon :donor:

@JessTheUnstill that works for me, and clearly shows 2FA under Account, but not when I browse to Account, odd

15 Nov 2022 at 15:04 | Open on infosec.exchange
Simon :donor:

@JessTheUnstill hmmmm now it is, and now I just dont know if I was being completely stupid or not

15 Nov 2022 at 15:05 | Open on infosec.exchange
Jess👾

@staustellsimon Yeah I spent a while looking for MFA myself. It wasn't obvious at first.

I think it's because Account isn't expanded by default. So you click on infosec.exchange/auth/edit and there's nothing on that page for MFA.

It's not until you go BACK to the menu that you see the MFA sub menu.
15 Nov 2022 at 15:11 | Open on infosec.exchange
Simon :donor:

@JessTheUnstill I think that must be it! I should be better than this really 😜​

15 Nov 2022 at 15:13 | Open on infosec.exchange
SekhmetMedusa
Andy
:antifa:‌ω‌:antifa:

@jerry Tho that only works if your browser stores your credentials

15 Nov 2022 at 14:55 | Open on chaos.social
Brycicle
@lanika@mastodon.design

@jerry I don't see the option in #Tusky, I will go to the browser but it would be a good idea to get the apps to enforce it too.

15 Nov 2022 at 15:04 | Open on mastodon.social
Gyoo
lp0 on fire :unverified:

Enabling #2FA was one of the things which I did soon after creating my account (while looking to see what configuration options were present). Just as well that I did.

15 Nov 2022 at 15:12 | Open on social.linux.pizza
Go Up