SCAM 2FA Apps!

[@natemarx4999]

Naomi is a gem 💎

[@natemarx4999]

@@PaulyTater Blinding our vision precious.

[@sevenelven]

Simps everywhere

[@natemarx4999]

@@sevenelven Aww, you learned a new word. 🥰

[@sevenelven]

@@natemarx4999 uhh thanks? Lol

[@NaomiBrockwellTV]

@@sevenelven Hi! You can give me compliments too. It helps balance out the nasty ones!

[@ikust007]

Excellent guests . And the host is sublime .

[@savagepro9060]

Dark Side of 2FA = Mouse Guarding Cheese!

[@SECYBERSAFE]

This is a video people should pay attention to.

[@thomasmuller3.89-0W]

A (yearly) update on the best VPN, email, DNS, browser, search engine, etc. would be very cool! ☺️ Or a website that keeps updating when your top 10/top 5 change and why they change. ☺️

[@Steven_nevetS]

Excellent content. I think these clone apps/sites are not just targeting 2FA but all apps

[@owenwadders3689]

Naomi , love you and your videos! You explain everything so well but in a way a dummy like me can understand! Thanks

[@reefhound9902]

FOSS is the only way to go for a security app. SIM swaps can be mostly avoided by a smart user. Take away SM swap and SMS becomes safe and even has advantages over a hardware key. How long until someone starts making counterfeit hardware keys that look and act just like the real thing only they keep a copy of your data as well?

[@polyesterbebe]

algorithms

[@NaomiBrockwellTV]

gracias

[@OH2023-cj9if]

The problem with a key is that you need two and have to carry something else about. If they were smaller, I would use them. I would use Aegis.

[@NaomiBrockwellTV]

Do you carry a house or car key around?

[@yumedan]

Interesting video. One thing I do wonder is how those free 2fa generators that seem legit earn their money. When things are free, usually you are the product.

[@ikust007]

You are such a splendid mind !

[@jerryfacts9749]

This is interesting about "2 Factor Authentication" applications. I have no trust in most apps unless I specifically know the author is authentic and safe. Best to use the phone number in your mobile phone with SMS service. Nobody else can have the same phone number as your mobile phone. The system is designed that way. The only way possible for someone to have your SMS messages is if they steal your SIM card, or steal your phone and have the password, or be able to transfer your SIM card phone number to a new one. It is important to have some type of arrangement on your file with your mobile phone service provider to not allow SIM card transfer or replacement unless you go in person to one of their dealer locations, have two photo IDs, and a pass code with them. This way if someone has your mobile number, they cannot just simply transfer the SIM card phone number. This can be a pain for you if you need a new SIM card. You can also ask that your SIM card is locked to your device only, but if you want to swap the SIM card to another phone you will have to have the lock transferred by your service provider. A safe way to use a mobile phone is to never give out the mobile phone number. Have a land line phone number permanently forwarded to your mobile phone, and give out only the land line number. This way anyone who calls you is not directly calling your mobile phone number. A land line cannot accept SMS messaging. Only services you log in to should have your mobile phone number to allow them to use the 2FA system with your phone's SMS messaging.

[@kimberry999]

Time for Congress and FBI to put as much pressure on app stores to verify their offerings as the FBI puts on Facebook to fact-check and remove harmless comments and opinions.

[@alfredharrison597]

I will NEVER understand why anyone in their right mind would use their FACE (unique identifier) OR THEIR FINGERPRINTS (yet another unique ID) on a device thats tethered to the internet pretty much 24/7 and on a device that may or may not be transmitting those unique ID's to some 3rd party either deliberately or by interception of that information, and on a device that has been shown that corporations habitually use to take away our freedoms and liberties every bit day by day. I will never understand humans sometimes.

[@psbarry]

Excellent video

[@Cre-Art]

Good data, thanks. What do you thnk of getting codes via email or phone call, rather than SMS text?

[@grandetaco4416]

So much for the app store being safer. "side loading" is dangerous they say. Sounds like you are taking your chances either way.

[@personalJoke]

Waited and waited but I never heard what apps to avoid.

[@ciprianadrian21]

I use Microsoft Authenticator and 2 Secure Keys

[@knapptryckarnaLE]

Mwuahahahaaaa my chastity belt are now more secure than ever!

[@acevaporchill6432]

She very good thank you

[@Centerflow]

Brilliant

[@tysonofficial8527]

Nice video mam

[@ArmandoCalderon]

That dam evil hacker.

[@benban1863]

Ok how would they be able to get your SEID, EID, or IMEI to do this? If your phone is locked how would you be able to stop this?

[@davinp]

SMS text authentication is the least secure of the 3 authentication methods, so try not to use it if poosible

[@JohnSmith-zl8rz]

Why Apple permit all those apps in the App Store?

[@ikust007]

Looks like the VPN cartels …

[@Memee833]

EYES ARE YOUR IDENTITY...................

[@SuperWolfkin]

The solution for that is to always carry with you the "Eyes of a Stranger". I saw a paper about this from a group called The Payolas.

[@Memee833]

@@SuperWolfkin always have eyes on......because eyes are on you 24/7 365....

[@glbjr309]

Sooo, no Robinhood. Got it

[@davinp]

stop focusing on Apple. What about Android?

[@benban1863]

How can they do sim swap if you are using an Apple iPhone with only e-sim?

[@NaomiBrockwellTV]

esim is functionally no different to a normal sim. number just gets ported to a new IMSI

[@muaawiyahtucker]

Best to use apples own TOTP built into iOS

[@IdkG7]

Wrong Raivo OTP for iOS or Aegis Authenticator for Android. Or even better hardware 2FA such as Yubikey

[@muaawiyahtucker]

@@IdkG7 why would an external OTP be better than a native one? Honest questuin

[@IdkG7]

@@muaawiyahtuckerThe ones I listed are open source meaning you can see what ur does if you view the code, not in the cloud. This makes it superior for security alone

[@javierrangel3020]

❤❤❤❤❤

[@jsidneysears814]

I couldn't concentrate on the information because I was so taken by Naomi's Beauty! I'm jus' sayin'! I'm not a "perv" just an old man respecting Gorgeousness? 😉

[@salims3660]

Aegis authenticator is what i use and its great thank you reddit

[@poobd]

This channel has both given me confidence and anxiety LOL

[@NaomiBrockwellTV]

knowledge enables us to empower ourselves and make more informed decisions! :)

[@jbrock8596]

Exactly right.

[@ligerllama]

Naomi has that affect (effect?) on people. Now read what I just wrote again if you're neurotypical or neurodiverse. 🙊🙉🙈

[@2Nu]

A most informative yet sobering segment. It only stands to reason that it is just a matter of time before AI driven scam apps will become so prevalent that they will become virtually indiscernable from legitimate ones..

[@heyRex]

Seems like the app store could have liability for letting these scammers steal seeds

[@iamslf]

i feel like a lot of liabilities go away when a user agrees to the terms prior to using the app store.

[@Huru_]

You and these guys been doing God's work. Thank you.

[@laurpflorin]

Also something to note: 2FAS and Microsoft Authenticator have biometric lock on the app itself while Google Authenticator doesn't, at least on Android. This makes the former options even more secure

[@alvaromonteiro7766]

In iOS Google Authenticator also has biometric lock like Microsoft Authenticator.

[@laurpflorin]

@@alvaromonteiro7766 that's good. I mean I'm genuinely happy for ios users and even more pissed at Google now. For their own Android OS which has biometrics built in, they couldn't implement it yet🤦‍♂️

[@SuperWolfkin]

It really appreciate that in the end you point out the spectrum of security. That not all of these concerns affect all users. Some of us aren't going to fall for dark app design but some of us will. We can adjust as needed. I haven't flipped over to hardware yet but I'm using three different apps. Authy (Desk/Mobi), Aegis (Mobi), an open source browser extension (Desk). Definitely something to be mindful of regarding the apps.

[@ikust007]

Good points .

[@IdkG7]

Authy is owned by Twillio who got breached and Authy also requires a phone number which can make your account vulnerable to sim swapping attacks. I would recommend Raivo OTP for iOS or Aegis Authenticator for android or even better a hardware security key such as Yubikey.

[@SuperWolfkin]

@@IdkG7 Welp I'm not sure if you finished reading my post but I'm aware of the breach with Twillio. And hardware keys keys won't work with my use case. In my particular case I'm not concerned about SIM swapping but thanks for the general concern and the tips.

[@abrahr2420]

Thanks Naomi for breaking it down and keeping it real!!

[@breadcircuses6085]

Smartest, hottest redhead on KZbin!

[@jigmeybhutia8857]

Thanks Naomi for enlightening us all😇

[@hughmaitri5367]

Great to see you and Heidi talking together. My 2 fave tech and crypto girls keeping it real 🙏🏾💕🙏🏾

[@NaomiBrockwellTV]

She's great :)

[@brianm9331]

You should mention SIM-LOCKING if you want to use SMS for the second factor. It sounds like that mitigates the risk of sim-swapping. Now all you have to worry about is a man in the middle attack for SMS to get your codes.

[@XSpImmaLion]

Separate discussion, but this is one of the reasons I absolutely hate generic names for apps with common functionalities, and all big tech companies are guilty of doing this. It's just another anti-consumer measure to confuse people, and it ends up enabling bad actors to do stuff like that - release their own app with some generic name that will live in peoples phones there scamming them out of their privacy and security because of a greedy decision by big tech. This includes not only authenticator apps, which a whole ton of companies decided to name it simply as "Authenticator", but also almost all more common or system apps such as Clock, Calendar, Weather, Dialer, Messenger, MyFiles, Gallery, Camera, Voice Recorder, etc etc etc. In a fair world this should be grounds for anti-trust investigations. A whole bunch of those apps are proprietary and often mass harvesting data without authorization. The practice should also be considered a dark pattern.

[@SuperWolfkin]

That's an interesting point. I've certainly had that problem distinguisihing the contacts app I downloaded vs the one that came with my phone.

[@benny10000]

2FAS is open-source and the most featured app.

[@fabio.brunori]

Great content! Curious to see the next vid on the open source ones.

[@firalia]

2FAS is great! That's by far my fav

[@piyushdixit4879]

I Like your Video, Love From INDIA

[@LinuxZombie]

andOTP has been abandoned

[@NaomiBrockwellTV]

It has? When was the last active development? I'll look into that, thanks!

[@okay4634]

flocke Unmaintained on Jun 14, 2022 andOTP GitHub

[@SuperWolfkin]

oh snap. looks like it HAS been abandoned. > This repository has been archived by the owner on Jun 14, 2022. It is now read-only. Seems he got a "big boy job" as it were and doesn't have time and energy to do even more work after that. I wish the developer well. Sounds like it couldn't happen to a better person.

[@NaomiBrockwellTV]

@@okay4634 will mention that in our upcoming followup video when we dive into open source options, thanks!

[@dannyboay]

Luv your delicious accent and your classy vintage garde robe. So bri-ish. But most of all your knowledge and desire to share it in such a simple and easy to understand way for such technical topics. Thank you for sharing Naomi. You are the queen of the geeks.

[@NaomiBrockwellTV]

"queen of the geeks" 😂 I'll take it

[@okay4634]

I like open source FreeOTP+ although I disabled network access which I guess is used for icons.

[@jonphinney1456]

This woman really does a great job. I wish I had found this channel sooner

[@NaomiBrockwellTV]

You're here now! Welcome 💛

[@thomasmuller3.89-0W]

Important video

[@3LegDogTube]

Sorry. I can't take a talking avatar seriously.

[@NaomiBrockwellTV]

the talking avatar doesn't take you seriously either, so fair is fair.

[@algorithminc.8850]

Thanks. Really interesting one - nice mix of what and how. Cheers!

[@FreerunMediaService]

Another better solution is not paying for the scam software. You can close the app most of the times and if not, just switch the phone off. When reboot your phone, just uninstall that software. The biggest problem is that people are more and more "click happy" and clicking every button they see. Think about the "don't push this button" test. Everyone is going to hit that button.

[@ericapelz260]

I am constantly asking myself how I have decided to trust this person/creator/company/news source/app, etc. It's essentially a process audit.

[@James-k6z5e]

❤LEIGH MCLEAN from everywhere as he keeps having to move on. My life mission is to stop him. Total Narcissist disorder, very dangerous individual. His poor kids will end up the same

[@JosephNYC623]

In addition to the official reliable authentication apps like Google and Microsoft, it's worth mentioning that Apple has a built in authenticator under settings in the password section. Of course, for those who have an iPhone.

[@nitinkumar29]

SMS is more secure than 2FA especially for eSIM. And SIM cloning is not easy anymore, it also need physical access to the sim and therefore more secure than Yubi keys.

[@martinwalker3088]

Thank you Naomi for highlighting this danger. You really are a treasure.

[@James-k6z5e]

❤ thanks for your help, I have been targeted for 6 years by Leigh McLean who is a covert Narcissist. I could barely type this, do you have any information for me?

[@JohnSmith-zl8rz]

Authy was hacked recenlty, Raivo iOS and Aegis Android are better, open source.

[@Warp10000]

I am sure that Yubikey is a fine product ... but disguising what is basically a paid promotion as educational video is ethically dubious at best ... disappointing ...

[@tusshaarpatil]

So much for Apple to not do anything for authenticity and still people believe that they respect our privcay bcoz they are premier and costly. Dont understand these money sucking corporates.

[@tomkn777]

Hi, can i have this question. How can i be able to figure out which app is real and which app not not real? Thanks

[@EbrahimHasan]

Would love to see more gentle sex representation in the KZbin tech community. Your contact is fab. Keep it up. 🎉

[@kushalraj]

I think apple’s 2FA in their password manager not being mentioned is a problem because even though they might be tracking usage, it’s inbuilt into all Apple devices

[@JosephNYC623]

Yeah. It's baffling why she didn't mention that, especially Apple being big on Privacy.

[@beriont.]

I just saw a video by The WSJ about the iPhone's entire security relying on the phone's lockscreen passcode and how all of your data on that phone can easily be compromised just by knowing that one short PIN... so i would never advise using Apple's options for password management and/or 2FA authentication, you're better off using a 3rd party app which offers a separate way to lock the app itself (and don't use the same pin as to your phone of course)

[@kushalraj]

@@beriont. while I agree that’s a problem right now, Apple will fix it. And the video wasn’t about the best way to keep safe and secure, it was about the easiest options that are better than “fake” apps.

[@James-k6z5e]

Companies dont mention as they make a lot off the Leigh McLeans of the world

[@AshManXP]

Why was this 8:03 not identified during Apple's manual app verification process?

[@double__dash__]

What about password managers with a OTP field, like 1Password?

[@thegorn]

I’d give Naomi my seed

[@Krishnendulaha]

Who are these people who buy an authenticator app??? 🤷‍♀

[@MaxRiley]

Is 2FAS auth app safe? Thanks

[@Anondady]

Great video

[@genericdude6551]

Scammers should go get a real job.

[@tigreonice2339]

Nice video

[@_OnlyBusiness_]

Fantastic content !! Thank you very much

[@ronm6585]

Thank you Naomi.

[@avvn9331]

Very. Ice and informative

[@grngrd]

Great show 👍 and a very important subject you are explaining in way, that everyone can understand. You have some great posters on the wall with Snowden and Monero. Could you please leave a link to where I can buy them? 😎

[@NaomiBrockwellTV]

Actually unsure where to buy them these days! I'll find out

[@robotwizard-tc6ck]

Great video. When will we see you on the Fediverse?

[@germanarturo11]

Naomi I miss you. Where have you been? You are even more beautiful today!!!

[@GoogleAdmiin]

keep up

[@sidrem8617]

Raivo is good too :)

[@michah321]

I won't buy a security key because I don't know how to pick one I REALLY trust. Forget Amazon... that's just a crapshoot...

[@IdkG7]

Yubico is easily the best security key maker currently and supports a wide range of protocols.

[@michah321]

@@IdkG7 yeah but where do I get one that I can believe isn't a knock off or fake. Does Best Buy sell them?

[@dyrepoliti]

Sorry in advance for potential bad English, Bilingual(English is not my mother tongue, yes it's on a good level but still) and dyslectic As long it's MS or Google expect your data to be collected and sold further. Yes as long it's free, you're the product but some companies are better than others. More and more companies have started to be more privacy based. I try to use the ones who are more privacy based more than the ones who are big known tech companies like MS, FB, google(alphabet), Apple etc.... Being online you have to sacrifice some privacy and information but some are way worse than others. Either you have to live outside the grid totally, or have 10 Firewalls, Anti-tracking, tor, VPNs and you're still not totally safe. So either you have to live not connected at all. Like in the middle of the forest in a cave and live like modern stone age. Or you must sacrifice something. You should try to use the more privacy based type of companies. The most secure way to use MFA is actually the HW keys which looks like an USB stick.

[@alexthemtaandr211weatherfa2]

That's highly illegal because of terms of service and bypassing device software via the website or an app is also illegal report this asp or else you'll be hacked, force restart your device if it's trying to force you to purchase something you don't want to buy, delete the website data immediately and completely delete the app from your account on all devices, update all devices to the latest version and turn on privacy settings to mitigate further hacking or fishing 8:44

[@kingwesleyXIV]

I wish youtube would also allow you to archive Playlist... I have several IT related ones (this one for example I put in a Playlist "security") it would make my life easier with the amount of Playlists I have 😅

[@v1rus_one]

Fortunate to find your channel! Good video! Keep it up! 👍🏼

[@NaomiBrockwellTV]

🙏

[@nomore-constipation]

The sad part is I know the exact users who would fall for this. Especially the one I married. 😂 ...but as she says, that's why I'm still around (for tech support) 🙂

[@chriszablocki2460]

There's nothing to steal. They seem to have it all already. And they're still compulsively scavenging. It should tell you something about their real natural place on the food chain.

[@AndrejPanjkov]

Ya gotta watch out for fake password manager apps too.

[@NaomiBrockwellTV]

absolutely

[@MichaelToub]

Great video !

[@adegbenroagoro5180]

i just came across your channel. I haven’t finished the first video but started scrolling through your videos. Subscribed for all your content👍🏾(I finished the video and greatly appreciate your content. Made me happy I’d decided all these years to stick with SMS. Now I need to get a good security key)

[@NaomiBrockwellTV]

here's a deep dive into sms to show you the other side of things! kzbin.info/www/bejne/nn20oaypZpmqjZI

[@adegbenroagoro5180]

@@NaomiBrockwellTV o Thank you very much. I'd heard about a year ago about the problems with using SMS for 2FA. I decided to stick with it rather than get an authenticator app.