urgent_skittle

The "something you have" means "something you physically possess and can't be copied". Logging in with username, password and an email OTP is 2-step authentication, not 2-factor, as multiple people can have access to the email account from different places at the same time.

TOTP also does not imply a second factor, it's just a time-based password calculated from a shared secret that can be stored anywhere, for example in your password manager alongside the username and password. And worse than your password, of which only a hash should be stored at the service you have an account with, they store the shared secret too (which can thus be leaked from their side), so TOTP is never fully hardware-bound, it always exists in at least two places. Passkeys _can_ be fully hardware-bound, with the secret only existing in the secure chip of your phone or hardware security key for example, not at any moment in its lifecycle exposed to user, service or potential attacker.

> Amazon (..) still requires TOTP when logging in with a passkey from an unrecognized device.

I noticed Amazon does that and it annoyed me greatly.

> I just tell it what countries (or states / regions) to download, and it downloads them.

This is exactly how Organic Maps works. You don't _have_ to zoom in on every region you plan on visiting to download it, you can just go into the menu and select a whole country or parts of it.

Sounds like this New York Times article:

https://www.nytimes.com/interactive/2018/12/10/business/loca...

Edit: or actually I was thinking about this article, One Nation, Tracked:

https://www.nytimes.com/interactive/2019/12/19/opinion/locat...

Which is one in a series they did after some employees of a data broker or digital ad company (if I recall correctly) leaked a dataset to the New York Times because they actually were concerned about this kind of dataset existing.

Indeed, and I was talking about the boot image, but some still refer to it as the recovery, i.e. LineageOS. I see LOS have changed their download pages now and correctly call the boot image boot.img instead, that's good. So anyway, just download the boot image alongside the ROM instead of extracting it, and rerun Magisk install before rebooting after an OTA, and it's all very doable. Not as easy as before, but not too hard either.

Sounds very familiar. I switched to Foxy Droid, an alternative F-Droid client, years ago partly because its search functionality is miles ahead of the official F-Droid app. The popular and newer Droid-ify and Neo Store are forks of it I think, so should offer the same improvements.

Top results for 'ssh' in Foxy Droid: ConnectBot (SSH client), SshDaemon (ssh server), RSSAid (RSSHub... nothing to do with SSH), Easy SSHFS (Sshfs with ssh client), Trigger (open doors via SSH), FiSSH (SSH authentication via fingerprint), TeamBot (SSH client), SimpleSSHD (SSH server), etc.

You make it sound harder than it is. Most (if not all) ROMs offer the boot image as a separate dowload, often referred to as the "recovery"; LineageOS is one of them. You only need to patch and flash it once, after that you can just open Magisk after the OTA update has been installed but before rebooting, and choose the "after OTA update" install option.