Tootfinder

lost my usb key; found it in the trash. must have swept it up with other debris when I cleaned my desk. oops
now where did I put my backup key and did I add it to enough things. well, I've been pretty diligent about putting 2fa recovery codes into bitwarden (yes that puts the 2nd factor next to the 1st factor but I don't have a better answer yet)
oh, bitwarden now requires 2fa, lemme make sure I have a backup key for that
... this is such a hassle. too bad it's …

Sehr cool. Ich komme nicht an meinen Postcode-Account, weil sie zwar 2FA anbieten, aber die Mail nicht ankommt. 😑

Officials: the scope of cyberattacks on US water systems now includes at least seven states and may be far wider; MN was just the first to publicly report them (New York Times)
https://www.nytimes.com/2026/08/01/us/poli

Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran
Michigan and Minnesota are among at least seven states coping with cyberattacks aimed at disrupting water systems nationwide.

Sources: the DOJ issued a subpoena to NYT freelancer Matthew Cole, seeking to force him to reveal his sources about a failed top secret mission in North Korea (Devlin Barrett/New York Times)
https://www.n…

Justice Dept. Subpoenas Times Freelancer in Effort to Identify Sources
A previously undisclosed subpoena, involving reporting on a failed SEAL Team 6 mission in North Korea, reflects the government’s expanding campaign to investigate leaks of secrets.

etrade 2fa wants to send a code to my phone number, sure. but.. if I click "try another way", it asks me to enter a phone number that it will send a code to? checkbox compliance, "yes we have 2fa"

«Critical Copilot vulnerability allowed hackers to steal 2FA code from users:
SearchLeak exploit shows why the industry’s approach to LLM security fails over and over.»
WTF: What is intelligent now and how to tackle what? Certainly not the usual popular AI for IT security.
☠️

Critical Copilot vulnerability allowed hackers to steal 2FA code from users
SearchLeak exploit shows why the industry's approach to LLM security fails over and over.

Die Instanz https://bayerwald.social läuft jetzt mit Softwareversion v4.7.1
https://github.com/mastodon/mastodon/r

Release v4.7.1 · mastodon/mastodon
Changelog Security Fix password authentication bypass in 2FA auth for LDAP/PAM/SSO accounts (GHSA-vx32-x96w-qq65) Fix Denial of Service when processing pathological JSON-LD activities (GHSA-vgm8-f...

TIL that I've actually created a few "high impact" packages on NPM (with 1 million downloads per week)... Just got this email from them (see screenshot)
If each one of these would just pay me $0.001, I could actually comfortably dedicate myself full time to these projects (which has been my long, long dream job). But the system and social contract around open source is completely broken and so I've to balance my time and try to sustain myself and my family via other ways for periods o…

Vincent Pastore, Whose 'Sopranos' Character Ratted Out Tony, Dies at 80 (Clay Risen/New York Times)
https://www.nytimes.com/2026/08/01/arts/television/vincent-pastore-dead.html?unlocked_article_code=1.2FA.wff7.h8LGHeBMYNMG&smid=url-share
http://www.memeorandum.com/260801/p53#a260801p53

made something cursed (hide data in fake 2FA codes) https://git.sr.ht/~jackiejude/fake-2fa-codes

In case you missed it, scientists have confirmed that cats sometimes lick each other just to be annoying. #cat #cats #caturday #licking #jerks [gift link] https://www.nytimes.com/2026/07/10/science/cat-grooming-licking-research.html?unlocked_article_code=1.2FA.0VpR.SCUmRDnPUgYv&smid=url-share

Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran
https://www.nytimes.com/2026/08/01/us/politics/scope-of-hacks-on-us-water-supply-widens-as-evidence-points-to-iran.html?unlocked_article_code=1.2FA.k92q.frV8abocJAzk&smid=url-share

Websites/apps that require you to enter a 2FA code sent by text or email that disable or impair copy-paste:
Fuck you, please go bankrupt fast and make room for companies that don't hate their users.
#Security #Rant

I had 2FA setup but couldn't generate the code, or some other recovery code I was supposed to have. But I prefer your explanation.

Wir werfen mit tollen Begriffen wie 2fa und Passkeys und anderen technischen Lösungen, und das mag alles fein sein, aber im Grunde fühlt es sich in der Praxis kompliziert und vor allem für Laien nicht wirklich verständlich an, und zum anderen haben wir an zig Stellen unterschiedlichen Kram, der sich anders verhält, und dem gewöhnlichen User zu viel zumutet.
Im Grunde fehlt uns ein Ort, um unter eigener Kontrolle einfach und für Laien nachvollziehbar Private Keys¹ ablegen zu können – un…

FDM CCS Insight: ~134M travel eSIMs will be used in 2026, up from 101.8M in 2025, challenging established carriers that generate 3%-5% of revenue from roaming (Kieran Smith/Financial Times)
https://www.ft.com/content/64ede483-c179-42fa-8fd2-f13b13cbd8ad

The U.S. Deported Him to Jail in Russia. Then He Escaped. (New York Times)
https://www.nytimes.com/2026/08/01/world/europe/russia-war-deserter.html?unlocked_article_code=1.2FA.eJTY.ZtuqxbLN2SRX&smid=nytcore-ios-share
http://www.memeorandum.com/260801/p41#a260801p41

Received email spam from newly registered socialdb [dot] xyz. Some kind of escrow racket for wannabe influencers.
Looks like if they find an email associated with your Mastodon account you'lll get subscribed to their mailing list.
Platform allows you to create an account using an email without verification and set 2fa via Tor. Just saying.

As Cease-Fire Teetered, Iran Plotted a Wider War With Aid of Its Proxies (New York Times)
https://www.nytimes.com/2026/08/01/world/middleeast/iran-proxies-war-oil.html?unlocked_article_code=1.2FA.W2My.4yFC1sz3jI5J&smid=url-share
http://www.memeorandum.com/260801/p44#a260801p44

1Password launches a new Claude integration for Mac that lets Anthropic's AI agent sign in to websites without seeing the user's password or 2FA code (Zac Hall/9to5Mac)
https://9to5mac.com/2026/07/16/1password-now-lets-claud…

1Password now lets Claude sign in to websites without seeing your passwords - 9to5Mac
1Password is launching a new Claude integration for Mac users today. It’s designed to let Anthropic’s AI agent sign in...

It's to the point that I'd rather have 2FA with my phone app just to avoid it, which I did when osu! introduced 2FA. I mean, shit, man. If there is a passkey option, I would do it, even if I can't do it on my phone since it is kind of old.
#Trakt

You won't want to miss today's Metacurity for the most critical infosec developments you should know, including
--OpenAI disrupted an elaborate Russian influence operation,
--Cyberattack disrupts Boston Scientific worldwide,
--Man accused of impersonating NSA hacking chief,
--Hackers steal confidential Nutex data,
--LACMA breach exposed sensitive personal data,
--Akira-linked attack hits benefits provider Paylogix,
--CISA red team exposes tale of two defenses,
--CISA pushes agencies to strengthen security logging,
--Hackers turn npm mirrors into phishing hosts,
--New loader delivers Amatera through fake CAPTCHAs,
--AI malware remains mostly stuck in the lab,
--Army moves cloud management under Cyber Command,
--WhatsApp strengthens 2FA and passkey security,
--ChatGPT Work can now handle authenticated tasks,
--Parking service breach exposes 73,000 payment cards,
--Hackers hijack Kylie Jenner’s X account for crypto scam,
--AI security startup Alice raises $140 million,
--Meta settles child-addiction claims for up to $17.1 billion,
--No, hackers didn’t steal a gazillion passwords,
--ICE seeks access to nationwide voter data
https://www.metacurity.com/openai-disrupted-an-elaborate-russian-influence-operation/

➤ OpenOlat 21.0 major release is out
Learning and coaching areas separated, new Rooms module with booking, Course Planner automation and to-dos, Word/Markdown import, AI essay questions with grading and formative feedback, new "Gap mixed" question type, 2FA one time code and much more.
#OSS #LMS #elearning #eAssessment #OLAT