艾美講Favorites  · otdSrsneopfam372h5ii1ut4m2a4ic89thc895t9u08ff82claf1h41c4340  · Shared with Publichttps://open.firstory.me/story/cmbum9ml8002501uoca8kap5uEP 140【聊天室】東吳翻譯所校友Kate Part 3《線上醫療口譯》114年5月1日~6月30日使用手機報稅真簡單，輕鬆確認「稅額估算表」，快速完成申報，還可以參加抽獎！網頁網址：https://tax.nat.gov.tw/alltax.html?id=1*****以上廣告由財政部提供*****1. 線上醫療口譯的工作內容是什麼?2. Kate經歷考試、培訓、再考試的過程。3. 詳細的培訓內容。4. 需要醫療口譯的情況有哪些?5. 工作時間是走美國時間?6. 接電話前有準備時間嗎?7. 時薪?月薪?算電話通數計薪?8. 這份工作的挑戰9. Kate會推薦這份工作嗎?

If you send links with a secret login token with email, then they should be single-use and expire rather quickly.

If the link can only be used once with a short expiry time and no info in the link can be used to derive secrets in the session it creates then you should be fine. Effectively, the link serves as an one-time password.

If so, then how is sending a link for password reset any more secure? Isn't logging-in using a magic link the same thing as sending a magic link for resetting a password?

A given secret from an authenticator SHALL be used successfully only once.

We strongly recommend the use of security keys and TOTPs wherever possible. SMS-based 2FA does not provide the same level of protection, and it is no longer recommended under NIST 800-63B.

We now take an opinionated stance on which second factor you should set up first – you'll no longer be asked to choose between SMS or setting up an authenticator app (known as TOTP), and instead see the TOTP setup screen immediately when first setting up 2FA.

But first, an important note — friends don't let friends use SMS 2FA.

The problem with using SMS-2FA to mitigate this problem is that there’s no reason to think that after entering their credentials, they would not also enter any OTP.

discussions about SMS-2FA get heated very quickly. I've found that SMS-2FA deployment or advocacy has been a major professional project for some people, and they take questioning it's efficacy personally

I believe that SMS 2FA is wholly ineffective, and advocating for it is harmful.

Fortunately, we found RingCaptcha (https://ringcaptcha.com), which has a the 'starter plan' that offers free 500 OTP monthly. Just a small plug for them for providing freemium service; they are highly reliable because they are integrated with all major global, and regional providers, e.g., Twilio, Nexmo, Infobip, MessageBird, etc., and send your OTP through the best provider/route based on country/phone carrier, and can auto fallback to alternative paths. This means you just need to integrate with RingCaptcha, without the headache of deciding which SMS/voice OTP provider has best combination of price and reliability, which is a real headache when you are sending OTP world-wide.

One-time passwords are generated on demand by a dedicated OATH OTP authenticator that encapsulates a secret that was previously shared with the verifier. Using the authenticator, the claimant generates an OTP using a cryptographic method. The verifier also generates an OTP using the same cryptographic method. If the two OTP values match, the verifier can conclude that the claimant possesses the shared secret.

The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.

If the run-time dependencies were shared across all applications depending on the same rebar.config file,

mark the workers as permanent or transient, so that if they fail they get restarted