• 0 Posts
  • 93 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle
















  • SuperIce@lemmy.worldtoMildly Infuriating@lemmy.worldMFA
    link
    fedilink
    English
    arrow-up
    1
    ·
    3 months ago

    Not necessarily. I found out that bitwarden can generate a QR code that you just scan with your phone that allows your phone to act as a passkey, no browser support required. I was surprised when I discovered that. I had set up my phone as a passkey in Windows, and Windows can use phones as a passkey directly; on Linux that’s not supported so it just gave me a QR code that worked seamlessly. It’s not like a browser URL, but actually triggers the phone’s passkey authentication, kinda like QR codes for WiFi authentication. Pretty neat.


  • To be fair, the backdoor only gets enabled when built as an RPM or Deb package, which doesn’t apply to Arch Linux, and also requires openSSH to be linked to liblzma, which is also not the case on Arch. So from what we know so far, the Arch packages should not have had the vulnerability. The risk now is whether there are other vulnerabilities or backdoors that haven’t been discovered which is why Arch made the update building directly from the git source instead of the known modified source tarball.