It’s just passing the buck for their service. They should be solely responsible for lockouts on their service.
Comment on Discord: Have you lost access to your email? no worries, just regain access to it!
NuXCOM_90Percent@lemmy.zip 3 weeks ago
I mean… It would be nice if they put a nicer message there. But I mostly agree with that.
Look up how people social engineer their way into apple accounts and so forth. The more you put the burden on a (perpetually) underpaid CSR the easier it is to steal an account, Spin a sob story and then harass the CSR until they just reset your password so you will go away. Except there is no guarantee that is YOUR password and now we have yet another stolen account.
ArmokGoB@lemmy.dbzer0.com 3 weeks ago
insufferableninja@lemdro.id 3 weeks ago
you seem to be misreading the message. if you no longer have access to your email account that is linked to discord, what the hell can discord do about it? nothing. so you have to contact the email provider’s customer service to get access to your email account.
this is not just reasonable, it’s the only way it could work. or do you think Google customer service will help you reset your lemmy password?
bogosort@discuss.tchncs.de 3 weeks ago
Also works on EA accounts. Got mine stolen through Customer Service a few months ago. But when I contact them through the email the account was set up with they don’t reinstate me.
Wish there was a solution to these problems that deals with both issues.
NuXCOM_90Percent@lemmy.zip 3 weeks ago
There is.
2FA. No, not the fucking “we’ll send you an SMS” bullshit that is increasingly used to just highlight an active phone number for spam purposes. Proper TOTP with the code backed up to a proper service (bare minimum, Bitwarden)
Someone can steal your password and even your email account (unless you TOTP that too…). They still can’t get into your account unless you are an idiot who gets tricked into providing the 2FA key.
In a perfect world? Have your TOTP credentials in one encrypted database/Bitwarden account and your passwords in another. In reality? Just use a trusted service. I used to be a big fan of Keepass but protecting that with a yubikey (or similar) is a huge mess.
FlihpFlorp@lemm.ee 3 weeks ago
OMFG YEEEEEEESSSSS I HATE THOSE I’m not even super duper security focused I just love the idea of even a bot farm has to guess a code within a 30 second window
Meanwhile sms codes usually expire between a ten minutes and an hour, usually a half hour, but thats if at all
As much as I hate them they’re better than nothing :/
lud@lemm.ee 3 weeks ago
I doubt bruteforce has been used in one of these attacks. The service should detect a bot entering many combinations per second.
The main problem with SMS is that someone could social engineer the mobile operator support to give them a new SIM.
Probably not something you should worry too much about unless you are in any way a target, but still.
victorz@lemmy.world 3 weeks ago
Quick question, how do you back up a 2FA “code” to Bitwarden? Sounds like a wise thing to do for my current 2FA accounts.
NuXCOM_90Percent@lemmy.zip 3 weeks ago
Really depends on your current tool so RTFM on that.
But when you are activating it in your account? There is a QR code you are supposed to scan. And there is almost always a button like “Having trouble?” or “Show TOTP Key” or whatever. Click that and you get a long alphanumeric string instead. Paste that into the TOTP field for Bitwarden (or Keepass or whatever) and it will generate codes for you.
Once or twice I have had to actually use my phone camera to decode the QR code so that I can manually type in the TOTP code/seed, but I think the last time I did that was in like 2020?
SnipingNinja@slrpnk.net 3 weeks ago
Would that work with my pin which is the equivalent of 40483770487025502574448? Or is a password better?
I think a pin like that is harder to remember for people, and even to get it using fingerprints is difficult because you cover a lot of the numbers giving false information