Security concern 2FA badge

[Gaby]

Hi,

Currently we're receiving a publicly displayed badge when we enable 2FA on our account.

My concern is that this basically gives hackers the chance to easily see which account has 2FA and which one doesn't.

It enables them to scrape the forum and specifically target the accounts without 2FA a little too easily.

Suggestion: Either hide the badge from the public or remove the badge.

 

[MentaL]

Just disable it off your profile...?

 

[Gaby]

Just disable it off your profile...?

It's actually the other way around. Hackers can see who does not have 2FA because these people don't have the badge and they can specifically target these accounts

 

[Niicke]

Hi,

Currently we're receiving a publicly displayed badge when we enable 2FA on our account.

My concern is that this basically gives hackers the chance to easily see which account has 2FA and which one doesn't.

It enables them to scrape the forum and specifically target the accounts without 2FA a little too easily.

Suggestion: Either hide the badge from the public or remove the badge.

In terms of security you are correct.
It is the same principle of not informing that a certain password is incorrect but email OR password.

 

[MentaL]

You would need to be really special to go to all that effort to force your way into an account on here. Note, there are several layers of protection. Xen will limit the IP on incorrect passwords, the webserver will filter it as a L7 based attack and itll also get captured at DNS/WAF level. If you get around that, Imunfiy will thwart it too.

Despite this, I will remove it.

 

[Niicke]

You would need to be really special to go to all that effort to force your way into an account on here. Note, there are several layers of protection. Xen will limit the IP on incorrect passwords, the webserver will filter it as a L7 based attack and itll also get captured at DNS/WAF level. If you get around that, Imunfiy will thwart it too.

Despite this, I will remove it.

I learned never underestimate the free time and lack of things to do for people who practice hacking (Except in real scenarios where security is essential, ofc)

 

[MentaL]

I learned never underestimate the free time and lack of things to do for people who practice hacking (Except in real scenarios where security is essential, ofc)

Sadly I lack any concept of this hacking, I am noob. Consider the matter resolved.