-1

Context

This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to trusted strangers from the internet by giving them accounts. The bottom line is that we do not know much about the website owners besides their contributions to the project.

Question

The website owners have recently introduced mandatory 2FA to all accounts on the website. You need a 2FA code to log in every time.

Hypothetically speaking, since the website is ran by 2 anonymous individuals who can "pack up shop" and go rogue whenever, would using 2FA on that website compromise me in any way? I do not understand what "data" I share with them by consenting to 2FA as I'm not very literate on this topic. Please explain it to me like I'm a 12 year old.

4
  • 2
    Can you explain which sort pf 2FA it is? Is it the sort where they SMS you a code, or is it where an app on your phone (e.g. Google Authenticator) shows a code that changes every 30 seconds?
    – nobody
    Apr 18 at 12:40
  • @nobody It is the authenticator application method. They let us set it up via scanning a QR code or inserting a code into the app manually.
    – D. Tunus
    Apr 18 at 12:46
  • 2
    "Trusted stranger" sounds like an oxymoron.
    – doneal24
    Apr 18 at 13:13
  • I understand, however this question does not benefit from going into detail on it. A trusted stranger in this context is someone who you've been working on the project with for months or years, but don't know anything about them in real life.
    – D. Tunus
    Apr 20 at 16:46

1 Answer 1

3

No, there is nothing malicious the owners can do with this

When you scan the QR code, you are basically setting up a shared secret key between yourself and the server. This key is used to generate the 2FA codes you enter when logging in. Since this key is specific to the site, the only thing the owners can do with it is log in to your account on their site. But since they run the servers themselves, they already have complete access to your account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.