On March 13, we will officially begin rolling out our initiative to require all developers who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Read on to learn about what the process entails and how you can help secure the software supply chain with 2FA.
If your account is frozen they should still be on the device. That would be a good time to change all your passkeys over to a yubikey, or to add one as a secondary token.
The keys being locked in a Secure Enclave is generally considered a feature, not a bug. That passkeys sync at all is somewhat concerning. I wouldn’t expect them to be exportable any time soon.
The use of a “secure enclave” for any purpose is a bug at best, because secure enclaves aren’t just secure against your adversaries; they’re also secure against you. This is intolerable. All machines must obey their owner, and “secure enclaves” by design don’t.
The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it.
It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens.
But you can only enable it, after you give them your phone number.
Also, apparently years of subscribing to channels is not as verified as giving them your phone number. They should just say “We really want your phone number and don’t give a shit about anything else”.
Before I deleted my accounts there, I remember twitter and facebook deactivated your account for “suspicious activity” if you did not provide a phone number when making it, and the only way to reactivate it was to give them your phone number.
Subscribing is more expensive than getting a phone number in most places. Hell, even in expensive Germany, a phone number is only about 2 months of subscribing.
As the other commenter said, only if you give them your phone number, and only through that garbage authy that does not use standard TOTP, but some proprietary crap, specifically made for twitch.
And if you give them a phone number, which another user will also try to use in the future, then the secret used for TOTP can change in any moment, which means if you exported the secret to e.g. Aegis and deleted that tracking filled garbage that is named authy, at one point the codes just won’t work anymore, and you’re practically locked out. Apparently support should be able to help, but they don’t give a single fuck.
Are they finally showing a proper QR code when setting it up?
At least that was the case for me. I removed 2FA to make the authy key invalid and activated it again. and they do the normal TOTP setup stuff during setup
That sounds good. I still have a working login somehow, but unfortunately I can’t disable authy, because they want a code to do that, and they won’t accept those that I have, even though it was working when I have set it up.
First of all, that they are totally unnecessary for twitch to be able to provide 2fa authentication.
Other than that, their app has tracker components, all secret keys are stored in the cloud, who knows whether that’s encrypted, but on your phone’s storage surely not, if yours is rooted you can just view it in a file manager and copy it to a normal code generator app.
Generally they support standard TOTP code generation, but for twitch they are using some weird shit that generates 8 long numbers (instead of the standard 6), of which the middle 2 is the same so they drop one of them, and then also codes expire in third the time as it is normally.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
Yep, should be standard everywhere
… for accounts you actually give a shit about
deleted by creator
If your account is frozen they should still be on the device. That would be a good time to change all your passkeys over to a yubikey, or to add one as a secondary token.
The keys being locked in a Secure Enclave is generally considered a feature, not a bug. That passkeys sync at all is somewhat concerning. I wouldn’t expect them to be exportable any time soon.
The use of a “secure enclave” for any purpose is a bug at best, because secure enclaves aren’t just secure against your adversaries; they’re also secure against you. This is intolerable. All machines must obey their owner, and “secure enclaves” by design don’t.
Hard disagree. That rules out yubikey, smart cards, and most any other credential storage systems.
deleted by creator
Apple actually describes the process for sync in some detail: https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web
Apple also describes the keychain recovery process in depth (I think this is when you’ve lost all devices?): https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1
The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it.
It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens.
deleted by creator
Just FYI, your account shows up as a bot. You should change it in your account settings.
deleted by creator
And not via SMS
And not the twitch way, where you have to have in an identifier, your phone number, but using proper, standards ways for it, like TOTP and such
twitch has TOTP
But you can only enable it, after you give them your phone number.
Also, apparently years of subscribing to channels is not as verified as giving them your phone number. They should just say “We really want your phone number and don’t give a shit about anything else”.
Before I deleted my accounts there, I remember twitter and facebook deactivated your account for “suspicious activity” if you did not provide a phone number when making it, and the only way to reactivate it was to give them your phone number.
true. But I think that’s mostly to make bots harder to create. Not as easy to get a phone number than an email address
I had a lot of success with this: https://phonegenerator.net/
A convenient scapegoat for getting your PII so they can sell your data at a higher value.
Subscribing is more expensive than getting a phone number in most places. Hell, even in expensive Germany, a phone number is only about 2 months of subscribing.
As the other commenter said, only if you give them your phone number, and only through that garbage authy that does not use standard TOTP, but some proprietary crap, specifically made for twitch.
And if you give them a phone number, which another user will also try to use in the future, then the secret used for TOTP can change in any moment, which means if you exported the secret to e.g. Aegis and deleted that tracking filled garbage that is named authy, at one point the codes just won’t work anymore, and you’re practically locked out. Apparently support should be able to help, but they don’t give a single fuck.
you can use any TOTP app. I use bitwarden
How? How do you import the secret key to it? Are they finally showing a proper QR code when setting it up?
My account is still locked to authy, and the support pages I have read are written as if it would still work through authy for everyone.
At least that was the case for me. I removed 2FA to make the authy key invalid and activated it again. and they do the normal TOTP setup stuff during setup
That sounds good. I still have a working login somehow, but unfortunately I can’t disable authy, because they want a code to do that, and they won’t accept those that I have, even though it was working when I have set it up.
do you have the backup codes somewhere? Could help
What’s wrong with Authy?
First of all, that they are totally unnecessary for twitch to be able to provide 2fa authentication.
Other than that, their app has tracker components, all secret keys are stored in the cloud, who knows whether that’s encrypted, but on your phone’s storage surely not, if yours is rooted you can just view it in a file manager and copy it to a normal code generator app.
Generally they support standard TOTP code generation, but for twitch they are using some weird shit that generates 8 long numbers (instead of the standard 6), of which the middle 2 is the same so they drop one of them, and then also codes expire in third the time as it is normally.
emphasis on the