Top products from r/ModSupport

Onions are delicious, but whenever I eat them in bulk I just make sure I'm wearing this.

I'm playing Diablo 3 again now that seasons are out on console. I'm really impatiently waiting for Stardew Valley to come out on Switch.

i'm also currently crocheting a welcome blanket, using a square pattern from this book. Also trying to organize a stitch-and-bitch for here in the office to make one :)

Eh, we have this happen in our sub sometimes too, especially with Amazon links. Usually if we have the user remove everything from the /ref... to the end it's ok.

So they post this:

amazon.com/gp/product/B005TH6BD4/ref=s9_qpp_gw_d99_g63_i2_r?pf_rd_m=ATVPDKIKX0DER&pf_rd_s=desktop-1&pf_rd_r=1B61T7S0V8P87BWNN4YD&pf_rd_t=36701&pf_rd_p=2079475242&pf_rd_i=desktop

and it gets auto-spammed often.

Have them cut it down to:

http://www.amazon.com/gp/product/B005TH6BD4

and there's usually no issues.

There are any number of possible "factors", but generally speaking people mean "something you know" and "something you have" when talking about 2FA, and that's where I'll stay for the purposes of this discussion.

"Something you know" covers passwords, answers to security questions, and anything else that's a piece of knowledge you could tell me and I could use to authenticate as you at an arbitrary time in the future.

Most commonly, a "something you have" is a device (smartphone!) that implements HOTP or TOTP. Since the algorithms produce different numbers every 30 seconds, someone who intercepts the number once has no way of predicting what the correct number will be after the 30-second period has finished. This is really important, because it means to successfully compromise your account, an attacker not only has to steal or guess your static password (which they can do remotely), but steal a physical device that you probably keep on your person, and either alert you to it being stolen or copy the inputs the device uses for the OTP algorithm (which isn't trivial).

Personally, I use a Yubikey and either U2F or their HOTP/TOTP app. It's pretty cheap compared to most HSMs, and is significantly less likely to be compromised than my computer or phone. For most people, an OTP app is sufficient, but since I often find myself with full-access Amazon credentials for companies and things like that, I have a bit of a more paranoid risk model than most.