And the auto-submitting TOTP entry form where you’re apparently not allowed to make a typo. And obscuring the TOTP number like it’s a password or state secret.

I feel like I’m stepping around landmines replying this, but I never liked the analogy either. It works fine at a small scale, and I’m fine with that, but everyone here wants to apply it universally at a macro scale to the point it’s just ridiculous.

e.g. If a nazi moves in down the street, and everyone else doesn’t up and move, regardless of their financial situation, you live in a nazi neighborhood. Guess you and your kids should just go live in your car because…moral purity or something.

I gotchu.

I’d like to see some of the novelverse villains. The Grigari come to mind.

They’re kind of like the Borg but turned up to 11.

Solutions that work for a corporate application where all the staff know each other are unlikely to be feasible for a publicly available application with thousands of users all over the world

This is something of a hybrid. There will be both general public users as well as staff. So for staff, we could just call them or walk down the hall and verify them but the public accounts are what I’m trying to cover (and, ideally, the staff would just use the same method as the public).

Figure if an attacker attempts the ‘forgot password’ method, it’s assumed they have access to the users email.

Yep, that’s part of the current posture. If MFA is enabled on the account, then a valid TOTP code is required to complete the password reset after they use the one-time email token. The only threat vector there is if the attacker has full access to the user’s phone (and thus their email and auth app) but I’m not sure if there’s a sane way to account for that. It may also be overkill to try to account for that scenario in this project. So we’re assuming the user’s device is properly secured (PIN, biometrics, password, etc).

If you are offering TOTP only,

Presently, yes, but we’re looking to eventually support WebAuthn

or otherwise an OTP sent via SMS with a short expiration time

We’re trying to avoid 3rd party services, so something like Twilio isn’t really an option (nor Duo, etc). We’re also trying to store the minimum amount of personal info, and currently there is no reason for us to require the user’s phone number (though staff can add it if they want it to show up as a method of contact). OTP via SMS is also considered insecure, so that’s another reason I’m looking at other methods.

“backup codes” of valid OTPs that the user needs to keep safe and is obtained when first enrolling in MFA

I did consider adding that to the onboarding but I have my doubts if people will actually keep them safe or even keep them at all. It’s definitely an option, though I’d prefer to not rely on it.

So for technical, human, and logistical reasons, I’m down to the following options to reset the MFA:

1. User must contact a staff member during business hours to verify themselves. Most secure, least convenient.
2. Setup security questions/answers and require those after the user receives an email token (separate from the password reset token). Moderately secure, less convenient, and requires us to store more personal information than I’d prefer.
3. Similar to #2 except provide their current password and a short-term temporary token that was emailed to them when they click “Lost my MFA Device”. Most convenient, doesn’t require unnecessary personal info, possibly least secure of the 3. Note that password resets require both email token and valid TOTP token, so passwords cannot be reset without MFA.

I’m leaning toward #3 unless there’s a compelling reason not to.

I thought about generating a list of backup codes during the onboarding process but ruled it out because I know for a fact that people will not hold on to them.

That’s why I’m leaning more toward, and soliciting feedback for, some method of automated recovery (email token + TOTP for password resets, email token + password for MFA resets, etc). I’m trying to also avoid using security questions but haven’t closed that door entirely.

Personally, I love that layout.

I’m always at a loss for what to put up as wall decorations, and I hate rats nests of cables. Win-win!

They’re separate queens and separate collectives/cooperatives.

The Jurati Cooperative is, as of the end of Season 2, guarding the spatial anomaly that formed in the beginning of S2. They’re completely absent from the third season. Which I can understand since S3 was a fan-service reunion (which I loved) and there just wasn’t room in the 10 episodes for them.

The queen from S3 is the same one from VOY: Endgame and First Contact and part of the same collective since they were first introduced in TNG.

The new one affected the other one?

AFIAK, no, they had no effect on each other. The alternate timeline queen (that turned into Queen Jurati) was not the same queen seen in S3 or elsewhere. That queen was from a 2401 that no longer exists. She and her cooperative only exist because they went back in time and took the long way back to 2401.

Loops finally seems usable now. I tried the beta a while back and it was kinda “Meh” but it’s improved significantly since. And you can browse on the website now, too. I’m not into short form videos, but credit where it’s due.

Well, I do like short form videos, but I hate panning for the gems and just let my friends send me the ones that rise to top.

It’s so common for “anti-censorship” to be code for “Nazi-friendly” that I’m immediately suspicious of any platform that uses that as a selling point.

I’m similarly suspicious, but it’s not just code for “nazi-friendly” but also crackpots, maladaptives, etc. Rational people who read and say “anti-censorship” in this context know it means that it’s not beholden to corporate or government interests. But everyone else seems to want to interpret that as “I can say whatever I want! How dare you mod anything I say?! Freeze-peach, y’all!”

I wish they’d pick a different term for these non-corporate alternatives, but I don’t have a better suggestion to offer right now.

The irony of Lennart “let’s change everything about Linux because I know better” Poettering creating a company called Amutable is not lost on me.

But also, that tracks because now it’s “I know better so now you can’t change anything” which is pretty on brand.

Speaking of noticing things:

What do you call Jeffrey Combs standing around by himself?

“A Star Trek convention”

And also Secretary of Treasury

Star Trek but without the show’s lessons…isn’t that basically just the Dominion from DS9?

Nice. I’ll look into that one.

My ultimate goal is getting a decent-sized touchscreen, putting an LCARS-themed HomeAssistant UI on it, and hanging it up as a functional MSD for my house.

Well, Kosst Amojan is one of the True Prophets (deep reference from “DS9: Millennium”).

My earbuds are the over-the-ear style, but I am now thinking about adding a chain to one of them and it would sort of look like this.

Sounds about right. I held onto my 16:9 OnePlus 3 until the battery completely gave out in 2023 or so. It was the perfect size, and I hated the 2:1 ones that came after. Tried a OP Nord N200 for about a week but returned it.

Daily driving the Minimal Phone now. It’s not the highest resolution by any stretch of the imagination, but it’s 4:3 and makes current phones look even skinnier than when I was used to 16:9.

The only thing preventing me from looking into this further is it’s yet another tall-skinny phone. I don’t know which manufacturer popularized that ridiculous aspect ratio, but I hate them and everyone who followed suit.