**** Please enable 2FA on your OcUK forum account ****

Bouton Aide said:
Well your clearing your cookies not sure what else you want. That's why it's logging you out.
Click to expand...

I knew that already and I have already said what I want several times. I want people to stop saying something that isn't true.

There's something else I want too - to know if I can use a hardware 2FA device such as a Yubikey or Onlykey for these forums.
 
cheesyboy said:
Already had to redo the 2FA.
Click to expand...
Make sure the box is ticked to stay logged in and don't block cookies or keep clearing them.

The mods and OcUK staff have been using 2FA for a very long time, it works perfectly well. The only reason it will keep asking for authentication is if you're blocking the cookies or haven't ticked the box to stay logged in.
 
All I have to say is security online is only going to get bigger as time goes on.

This is a little tiny thing compared to what's coming.

Feek said:
Make sure the box is ticked to stay logged in and don't block cookies or keep clearing them.

The mods and OcUK staff have been using 2FA for a very long time, it works perfectly well. The only reason it will keep asking for authentication is if you're blocking the cookies or haven't ticked the box to stay logged in.
Click to expand...

In before the tin foil hat crew comes (IBTTFHCC) to say OcUK is tracking them.

:D
 
Bouton Aide said:
What do you lot hope to achieve by clearing cookies every time the browser is closed?
Click to expand...
what's the point in giving cookies a lifetime across sessions, it just facilitates tracking, if you have no settings/form data you want to preserve for a site, just nuke them each time gucci & braces.
if blocking of 3rd party cookie access was compromised, other sites could share stuff via an OC cookie, too.


Personally Authy on Windows seems to have a memory leak , mine is often up to near a GB, which I need to get to the bottom of, comprmising authy would be the coup
 
Angilion said:
I could probably set an exception for OcUK...but is it OcUK?
Click to expand...
Yes, xf_tfa_trust on forums.overclockers.co.uk.

Blocking third party cookies is wise, but I think deleting all cookies on session end is unnecessary, but that's up to you.

jpaul said:
if blocking of 3rd party cookie access was compromised, other sites could share stuff via an OC cookie, too.
Click to expand...
Well it would be their cookie not OcUK's.
 
Bouton Aide said:
I can live with that, I thought this was a tech forum? :cry:



2FA isn't about two devices - It's about 2 authentication methods. In this case it could be an app that's installed on a PC to do the second token auth, or another device or email authentication so in reality someone needs 2 things to get into your account.

Without both they not getting in captain.
Click to expand...

By definition yes, although if you just requiring two different passwords, its about as lazy as you can get.

Now you do need sms/voice authentication for things like transfers now, they should do that for logging in as well.
 
Werewolf said:
Let me guess you log in using the app on your phone?

Your phone being one level of security (hardware ID), the log in onto your phone being another (face/fingerprint/pin/gesture to unlock the phone), and the password in the app being a third?
Click to expand...

No just use the website, main phone is rooted, and I dont trust android, so only use virgin money app on my non rooted phone as they killed their website.
 
It’s really not hard to do.

Most decent websites / services offer 2FA and it is the easiest way to prevent unauthorised activities in the event that someone gets your password, regardless of how complex it is.

Most password managers (1Password, lastpass etc) can auto fill 2FA/OTP codes directly in the browser, so I’d suggest that if you’re finding it too difficult to grab a phone to generate a number then you’re probably better off looking at installing a password manager with a browser extension.

Hell, the 1Password extension on Edge auto fills the username and password AND then the 2FA code when the browser directs to the second page. It’s one click of a mouse and that’s on my awful work laptop :p
 
Let the Philistines flounce. What's left might befit a tech website after all. :p

Angilion said:
Yes. Every time I close the browser. Every time I close a tab, for all cookies set within that tab. Every time a cookie hasn't been used for 1 minute.

I could probably set an exception for OcUK...but is it OcUK? Just this page alone runs scripts from 11 different places. My security and privacy settings are blocking 9 of those 11. I've no doubt that if I allowed them to run they would in turn run more scripts from more places and I've no doubt that some of them would be some form of spyware (even if it's "just" tracking every webpage I visit and keeping a log to sell to advertisers).
Click to expand...

Reading between the lines I think we have similar threat models/opsec. What browser are you using though? Firefox has full cookie compartmentalisation nowadays. Just enable Enhanced Tracking Protection > Strict in settings, and then even without clearing cookies or whatever nobody from domain A can track you across domain B or vice versa. Now $(tracking company) and everyone else gets a new 'jailed' cookie for every domain you visit. They're kept in separate per-domain 'jars'. If, say, Facebook is trying to place a cookie on OcUK and a cookie on YouTube (why aren't you using Invidious? :p), it'll have one cookie in the OcUK jar (only readable on OcuK) and another cookie in the YouTube jar, etc.

tMnz1QI.png

Tracking you (using cookies) is now impossible, versus the usual method of allowing Amazon/DoubleClick/Facebook or whomever to access a single cookie from every domain you visit, giving them full birds-eye view of your browsing. Further disable all third party cookies if you must. This out of the box setup negates the need for effectively having private browsing enabled 24/7.

If you add in CookieAutoDelete extension on top, you can still set it to delete all cookies every time you change domain, except the few you have added to the whitelist. That way, everything's gone bar the things you want to keep (OcUK, forums, Github/Gitlab, your nugget porn, whatever) and you're solid. Don't forget uBO in 'hard mode' (or use NoScript), but it sounds like you have that covered. If you're really strict, use arkenfox user.js to harden the browser, add in javascript restrictor and etag stoppa (or Trace or ClearUrls at your fancy) and enjoy...

Now there's no excuse not to enable MFA without moaning, you great banana. :)
 
You must log in or register to reply here.
Back
Top Bottom