Technology

59440 readers

3634 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

355

Over 5,300 GitLab servers exposed to zero-click account takeover attacks (www.bleepingcomputer.com)

submitted 9 months ago by neme@lemm.ee to c/technology@lemmy.world

50 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] Mikina@programming.dev 2 points 9 months ago (1 children)

I see. IIRC from school, "factor" actually has a definition - it's either something you have (keycard, phone), something you are (biometrics) or something you know (password).

For authentication to be truly an effective MFA, it would have to require at least two of those factors. And that's also why I.e email isn't really a MFA.

So, I guess it boils down to where are you storing your passwords. If they are also in the password manager, then, its only 1FA, because knowing your password manager password is enough to defeat it. (Or, if someone finds a zeroday in the pass manager).

[–] CubitOom@infosec.pub 1 points 9 months ago

It's still two separate passwords so I think it qualifies as 2 factors.

But yes the password manager has one gpg key which only has one passphrase used to decrypt the passwords saved in the password manager. So if that was compromised then so would all passwords