Post

It was a phishing email that hijacked the 2FA? You are implying that the maintainer did not follow these practices? Also: Trusted publishing wouldn’t have made any difference in this case Provenance would only have helped if one would refuse any non-provenance versions

So I came up with four rules, each adding a tile to the roof of security. There’s no single, universal rule that can block every kind of attack.

Passkeys can protect against phishing emails—users simply cannot grant account authentication under an unofficial domain, unless they manually type in their password.

bsky.app/profile/notw...

That said, the guide in the post here to what to do is GREAT. Everyone should go and do those (but you have to do all of them, cant leave out the 2fa one).