Well its now time to retire the script. Gmail has had native search operators with this functionality (has:nouserlabels or -has:userlabels) for a few months now and they do work very well. So say goodbye to gmailUnlabelled!.

(PS: To search for labelled messages use has:userlabels).

Sounds familiar?

Well not so fast! The way the most common 2FA (TOTP) works is by having the authentication server and the application on the user’s device share a common secret (“key”) during the initial setup. When authenticating a user, they both come up with a seemingly random magic number derived from the shared key and the current time (for this discussion, lets assume they both have coordinated time). If the magic numbers match, then the user is authenticated since different users are assigned different keys.

While 2FA protects you if someone obtains your password or your 2FA device, it does not protect you if your credentials are stolen from the provider. Unfortunately that is the most attack scenarios these days. The attacker may well steal the shared key too. It really depends on the provider and how they keep the keys safe, but there are no guarantees.

So remember, 2FA doesn’t mean automatic safety. Though it provides improved security, there is no reason to get lax. You still need to keep your passwords strong. If your provider is hacked again, change your passwords again!