stefano

crossposted from: https://lemmy.world/post/1290048

Given the recent attack, I think this is a good opportunity to remind of the importance of using 2FA.

(although it doesn't appear to make any difference in this case as session cookies were being exploited so login credentials were not needed)

But for me at least, this event has made me go back and take another shot at setting up 2FA.

I am happy to report I finally got it working on all my Lemmy accounts/instances, so I thought I'd share some tips:

• I still haven't figured out how to set up via desktop, use a mobile browser.
• Follow these steps:
  • Check the enable 2fa box on your account settings and click Save
  • A message will show about a button appearing when the page refreshes
  • The button usually doesn't appear for me at first.
  • You can simply manually refresh the page at this point to make the button appear
  • The button should now be visible. Click the button.
  • This opens a otpauth:// link which on a mobile device should be handled by a 2FA app if you have one installed.
• Authy does not work: It will generate a code happily but that code will not work when you try to login to your Lemmy account.
• Google Authenticator worked for me. It appears the type of TOTP code Lemmy is using is not compatible with some authenticator apps.
• I think if you can find a desktop app that registers as a provider for the otpauth:// links it may be possible to do on desktop as well.
• You can also pull the secret= value from the link to manually add it to an authenticator on/from desktop.

After several failed attempts previously, I finally figured out Authy was the problem and I have now secured all my Lemmy accounts with 2FA. Annoying that I have to use GA, but that appears to be an Authy issue not a Lemmy one.

2FA might not have made any difference today but it very well might in the future.

Stay safe everyone! 🔐

In the past few weeks, I have been experimenting with various available solutions. Initially, I was inclined towards kbin or mbin, putting Lemmy on the back burner. However, I faced a series of challenges related to frameworks and dependencies. The main issue would have forced me to use the latest FreeBSD packages, but this would have rendered the PECL Redis module too up-to-date and incompatible with kbin and mbin.

Upon closer examination, I noticed that kbin/mbin would offer a different interface compared to Lemmy, along with the ability to manage microblogs. This feature might be useful if one were to manage everything directly through them. However, we already have a well-established and operational Mastodon instance, so employing kbin/mbin would have led to an unnecessary redundancy.

I realized that, like with other solutions, I had to choose between patching and tweaking kbin/mbin or opting for Lemmy - which is perfectly compatible and effortlessly installable on FreeBSD and other platforms that support a Rust compiler.

Lemmy is the ideal complement to our Mastodon instance, Wiki, and other social tools. It replaces Reddit with open standards and broad Fediverse integration, offers effective moderation tools, and is both lightweight and speedy.

Additionally, Lemmy supports Markdown and allows subscribing to a community via RSS, enabling updates without the need for a membership.

Thus, the answer to the initial question can be succinctly put in two words: why not?