Before heading off to work (yep, after 6+ months of f'ing lockdown, we've been back to an office for a couple of months now!):

Does this also happen with a freshly downloaded copy of fSekrit, or only the one with your encrypted data? If it's the latter, 4wd has a point... and somebody needs to get their shit together and do more precise signatures

Apparently the space is counting all old versions of files, and so the culprits of space use are likely files that have many copies, but I can't figure out how to find such files..  Painful.

-mouser (July 26, 2019, 04:10 PM)

I believe versions are going to get reclaimed automatically (but probably are counted against the limit).

Deleted files, however, do not get deleted automatically - this pretty much got me locked out of my account. The client will not connect properly when you're above your quota, and the web interface is bloody useless... doesn't show totals for folders, so it's near impossible to hunt down what's taking up space. And with the amount of files I had (because versions), it was also painfully slow. Not that the local client is much faster, when I got access again by contacting support and getting some extra gigabytes quota temporarily assigned, clicking around some of the large folders would take several minutes.

(The knowledge base articles on cleaning up versions and trash via commandline didn't work either - you literally can't clean up with the client if you're above your quota. And that you have to shut down the GUI, if running, before being able to run command line actions is... bloody stupid).

Anyway, deleted files end up in a "trash" folder you have manually empty now and then, might be your issue as well, mouser?

So... now, after reinstalling the Authy app on their new phone. They cannot add the site to the authy app - to get access to the site - without scanning a QR code from the site, that is apparently only on the site, that they cannot access... Did you just think of a word that rhymes with firetruck??? I did.

-Stoic Joker (July 17, 2019, 12:58 PM)

Erm... I don't know how Authy works, but that sounds pretty normal for TOTP-style 2FA. You need your phone/whatever authenticator to give you a time-based key in order to access the site. If you lose that (and recovery codes, which you've hopefully stored somewhere safe), you're f*cked, as well as you should be. "Scanning the QR code" would be adding a *new* phone, with a new seed for the time-based transform.

Which for me...begs the question: Is this kind of idiotic catch 22 level circle jerk "normal" for these (security theater fad) 2fa authentication schemes?!?

-Stoic Joker (July 17, 2019, 12:58 PM)

TOTP-based 2FA is probably one of the best things you can do security-wise today (that still isn't too much hassle) - it's definitely not security theatre.

Unless it's done wrong by the site, and you can just call and social-engineer them, of course.