Observed arrival · 2026-10-29
Vixxing puts a live code on the help-desk phone call
An open-source, self-hosted tool for verifying callers before IT staff reset a password or MFA.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- IT help desks handling password or MFA resets
- Worth noticing
- Verification accepts a 30-second TOTP step of clock drift; CSV exports omit TOTP secrets.
Field notes
Enrollment starts with an agent generating a QR code and emailing it to the employee, who scans it into an authenticator app. On calls, the dashboard checks the spoken code and allows one 30-second step of drift in either direction. The page also describes bulk employee actions, CSV exports that exclude TOTP secrets, and Microsoft Graph email delivery with SMTP fallback. Its demo uses random codes, not real TOTP.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
⊠LoginAccess appeared gated
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue