Sep 6, 2026, 12:53 PMI’m seeing more than normal account takeovers. Please don’t click on telegram links and for the love of $deity, please use 2fa.
- Sep 6, 2026, 12:53 PM
Replies
SpaceLifeFormSpaceLifeForm@infosec.exchangeSep 6, 2026, 10:27 PMA thought: Always show a 2FA form box whether or not the user has 2FA enabled or not.
A tricky twist: Randomize the order of the username, psssword, and 2FA fields.
Tim Ward ⭐🇪🇺🔶 #FBPETimWardCam@c.imSep 7, 2026, 3:56 PM@SpaceLifeForm @jerry That's a good way to get passwords recorded in clear in your logs, that is. "Failed login attempt from user [password], password redacted".
- SpaceLifeFormSpaceLifeForm@infosec.exchangeSep 7, 2026, 10:27 PM
True. I did say it was tricky.
If what ends up in the username field is not a valid username, then just log a failed attempt with the ip address but not the username field.
The problem could happen today, just via simple user error.
The logs will look fine if your password is the same as your username, such as admin/admin. /s