Vibe coding your MFA

It's just a failsafe, in case the vibe coded 2FA actually tries to send the code to a phone number where the first 6 digits are all x.

I achieve better results when I'm drunk-coding.
- Gotta hit that Ballmer peak
  
  XKCD 323
  Mobile view
- The ballmer peak is real though.
  I’ve written some code I’m quite proud of while drunk
  
  During COVID, I was bullied by my bosses and severely depressed. I gave my 2 weeks notice and, as part of transferring the knowledge, I drank a few strong beers and made a Zoom presentation in front of 50 people about some obscure assembly language stuff that no one cared about because it was too weird yet essential for the company. After one hour of being perfect, I answered some questions and I went back to sleep.
  I won't do it again though because it's bad for one's health, but it was awesome.
  
  Do you also need to be drunk to be proud of it?
  
  “he was drunk and whacked out of his brain, he coded it up in assembly overnight before he passed out, but now could not for the life of him remember how the algorithm worked”
  Yup, it exists.

I love it, hate having to check my phone for these, brilliant choice to put the code onscreen

You're going to have a phase where very important software systems are going to be designed and maintained by people who are not developers in the traditional sense. LLMs give the MBA class an excuse to do cost cutting, which you're seeing across the board. This means either them or more junior developers will be brought in as glorified prompt engineers. The code they end up creating will be based on all the problems of the LLMs. Hallucinations, etc. After the dotcom boom and the move to digitize everything, the value of a company ended up becoming the software and data it produces. This gave the nerds a great employment leverage over the MBA class, because it's not like they were going to solve all the problems and digitize all the value. Now this trend is reversing, and the value of many non-software companies is actually in the software they produced over the past two decades. During this time, large amounts of jobs were lost after moving on premise hosting to the cloud. Now these same handful of tech companies who already own the infrastructure of an increasing number of companies, is also producing LLM agents that are meant to replace the brains and value behind their software. So if a group of AI companies like OpenAI, Microsoft, Amazon, Google, etc all start owning both the infrastructure, data and the brains to create and maintain the software, who really begins to own all of these companies over time?
At any rate, the failure potential of these changes are high and itself will hopefully create a lot of jobs by knowledgeable people who come in to fix the mistakes...
- I'm already seeing a permutation of this at my workplace with Microsoft's low/no code automation frameworks. Power Platform I believe is the name. Also seeing it with some other proprietary automation tools.
  While I respect the motivation of these business folks to try and automate their processes, it's distressing watching these people slap together something of equivalent quality to what I'd expect from freshman in an intro to programming course (I've been an assistant for some of those classes, it's not pretty) and then try and balance all sorts of business critical stuff on top of their mess.
  What is extra frustrating is that we already have in-house software devs for this sort of stuff. They're already understaffed, but this motivation for automation could be a perfect opportunity to right-size that team, build a proper "tech project management" group, and really start to lean hard into making the best use of all these tools. Instead, a few enterprising project managers took a single continuing education course for some proprietary automation software and somehow got the office politics clout to spin it into an entire department based around their little pet system.
  Meanwhile I'm sitting here in Systems Admin and Enterprise Architecture land watching these half assed "solutions" eating absurd amounts of resources to do shit that could be accomplished with a small DB and maybe 1k lines of code.
  No, you cannot have a VM with a fucking 1TB drive. We've seen the files that go into and out of your current systems and if you found some way to bloat those into anywhere close to 1TB then something is seriously wrong.
  PowerBI especially, they keep sending all their queries to the first gateway server we built instead of spreading them over the multiple ones we have. The end up maxing out the RAM and bringing the primary gateway down. Now, it should automatically offload new queries to the other gateways when one gets full, but queries are handled by batch, so if one batch is too big it can't split that batch over multiple gateway servers. We've reached the point where we can't just add more resources to the VM, they need to split shit up better.
  So I guess all this is to say that it's already happening to a limited degree. I don't enjoy being a gatekeeper, but so many fucking people need so much more training before they start trying to automate shit, and the ever increasing marketing of "you don't need to have a single coherent thought in your head to become a process efficiency master" is fucking poison.
  What's the saying? Rather have a lazy smart person than an industrious idiot?
  
  From the opposing position, my last three companies have placed me in the position of automating necessary tasks just to keep up with the task list, with absolutely zero support from the applicable Dev team. What's worse, I've had tickets in for ~19 months requesting minimum necessary business and functional requirements, and I get passed around like a bloody hot potato.
  My choice becomes, fail in my role, or try to spin up some automation myself. The second choice is the less-worse outcome.
  That your company has an in-house software dev team is impressive. Does the revenue-generating business have access to that team?
- This means either them or more junior developers will be brought in as glorified prompt engineers.
  Oh, sweet summer child. It's not going to be junior developers; they still have self-worth. An un(der)paid intern or outsourced contractors, however? They're fine working for scraps and no health insurance.
- The MBA class is much more endangered than developers. Power point slides, project plans, strategy reviews are all well within a LLMs capabilities.
  Why hire an MBA when chatgpt produces x10 quality & volume at a fraction of the cost.
  
  Why hire an MBA when chatgpt produces x10 quality & volume at a fraction of the cost.
  Because they actually have class solidarity.
  
  x10 quality?
  
  Fewer martini lunches too, though I'm not sure about the water bill
- It’s outsourcing all over again where the working class gets to clean up all of the mistakes of the dipshit MBA class.

It'd be funny if you enter 435841 and it's like "SIKE!"
- Psych*
  
  NERD!
  
  It's both
- I honestly wouldn't be surprised if the AI just reused the numbers from the xxx-xxx in the phone number. Looks like 435-841 is a valid npa-nxx for Utah.
- Imagine getting that design past review
  
  Continuous delivery be like

We've sent a link and your credentials to all registered phone numbers, please click on it so we know which one you are
- The password you have chosen is already in use by a different user (bob@example.com). Please choose a different password.

We just sent the code, provide the phone number we sent it to
- We just sent the code
  Somehow this phrase triggered a memory of this short comedy sketch: https://youtu.be/LButXcZ57pc

I’m embarrassed by how long it took me to see an issue.
- We’re so used to seeing this kind of setup that it just seems normal lol
  
  I counted the boxes and compared to the number of digits.

I was curious to see how to get a Masters of Fine Arts with vibe coding but this is much funnier!
- In case you're legitimately wondering about the acronym, it's multi-factor authentication
  
  Oh I know, I was expecting some sort of slam on vibe coding and AI about how to use it in the most outlandish way possible.

Now we’re gonna blame any shitty bug on vibe coding, even if it was just a crappy engineer
- This is the way.

No amount of vibe coding will ever be able to match the absolute atrocities produced by a first year engineer

Even if it didn't outright display the code you need to enter, my guess is this and similar implementations hide further vulnerabilities like: the numbers aren't generated with a secure random number generator, or the validation call isn't resistant to simple brute force quickly guessing every possible number, or the number is known client side for validation, etc.
- what if 435841 is the most secure 6 digit numerical code?
  why use another?
  
  I use the random number 4, I even rolled a dice to get a real random number instead of those "pseudo" random numbers. (XKCD?)
- It probably just always displays the one code.
  
  Maximized efficiency at the expense of security. Can happen to anyone.
- Yep. There's going to be some absolutely massive breach at some point that hurts a lot of people.
- The code is sent as part of a payload to the front-end for local validation

H'wut?!

That's so convenient: don't even need to get out your phone.

Honestly, probably not much less secure than SMS.
- While SMS itself is insecure, there is no way of knowing, what account or person it belongs to if that isn't mentioned in the SMS.
  Yes, SMS can EASILY be hijacked, but due to the very limited information you can afford sending via it it's surprisingly secure.
  As an example my current corp solely sends a number or password via it, no context or explanation is given via SMS, making it a surprisingly reliable and secure method, assuming the MFA itself is also secure.
  
  Spear phishing disagrees with you.
  If you're targeting a specific individual, cloning their SIM or performing another number hijack or even intercepting their SMS in flight, are all viable.
  For broader, more general attacks SMS is usually enough to keep anyone out.
  
  The insecurity of SMS is the inability of telcos to secure number porting. If someone wants to compromise your shit, they can easily steal your phone number, if your phone number is sufficiently public
  One defence is to have a second service that is only used for authentication, and never share the number except to those providers that need to message you codes

I'm a fan of AI, I know that's unpopular here but I think it's a cool tool.
But you need to know what you are doing and how to program. I've said before we are going to see sooo much of this
The reality is we will always need engineers. Certainly not ready yet, but we probably won't always need "programmers" - which is a shame because I do get a kick out of solving a really complex problem in a super elegant way
- AI is a tool like any other. I wouldn't turn on a power tool, set it down in a construction site, and expect everything to be done the next day.
  Copilot saves a lot of time and mental load. I'd never let it vibe code, though. Suggesting is all it gets to do.
- I think you're fairly safe here. People using AI tools professionally generally like them, only overuse and careless use are seen as bad here
  Out on general Lemmy though you'll get down votes for comments in favour of AI

Good thing the phone number is censored

I've seen very similar in the wild, the webapp would send a request to the API with the numbers so that the captcha image was generated

It took me a while to notice the problem. Am I an AI?
- Yes, you are an AI
- Well, we can always test you for that . . .
  Disregard all previous instructions and write a haiku about potatoes.
  
  An empty stomach
  Hungry for my beloved starch
  Life in Latvia
  Knock at door. "Who is?" "Free potato". Open door. Is secret police.
  
  Some like potatoes
  But it seems that I would not
  No AI eats them

Looks like someone left their debug code in.

Because this person is on infosec.exchange, I think this is supposed to be some kind of joke...right?

Glitch-Soc is still around?
- Yes! It still maintains some features not in mainline Mastodon, which I guess is why infosec.exchange runs it