2026-10-17 14:10 UTC
@stux@mstdn.social @jwildeboer@social.wildeboer.net @gbargoud@masto.nyc The issue here is not stolen tokens, but users who reused their password somewhere else, or got their password leaked.
We recently merged https://github.com/mastodon/mastodon/pull/40745 which should help for inactive users.
For active users, they should configure 2FA, and we are working on prompting them to do so when they log in.
Replies (1)
-
@jwildeboer@social.wildeboer.net 2026-10-17 14:22
@renchap@oisaur.com „forgotten” tokens however are *also* a risk that can be mitigated, in my opinion. In general I think they should have an expiry counter of 12 months that resets after every use. @stux@mstdn.social @gbargoud@masto.nyc