Post

Ben Werdmuller

@werd.io

Truly wish Bluesky MFA offered TOTP, passkeys, or basically anything other than a code in your email.

12/10/26, 11:12 pm5 reposts43 likes

SAME

Shared hosting of a @tranquil.farm instance has those features tranquil.farm Plus delegation to share accounts. I think it’s the second PDS we’ll run at @coop.pds.cosocial.ca if you want a Canadian instance (that doesn’t help @werd.io sorry!)

Boris

@bmann.ca

I’m guessing that Bluesky will batch some of those features along with rolling out support for OAuth in the main app

Alex McRoberts

@alex.mcroberts.me

I’d be even OK if the MFA email was sent in a way that iOS autofill pulled the code from the email received in the iOS Gmail app. @alexbenzer.com this should be a really easy fix and a pretty fix win to improve MFA for Bluesky.

+++

Emailed codes share the SMS and TOTP problem: a phishing page can ask for the code and replay it within seconds. A passkey is bound to the real domain, so it won't sign in on a lookalike site at all.