4 ms·
This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords
by dsmithatx 11y ago
This has me thinking about another possible attack. Say I don't want to hack all of Facebook or a specific account. What if I used a botnet to reset passwords and then use the six attempts randomly on each account I reset. Sure I'd only get a small percentage but, I would easily start hacking FB accounts. It's things like this that make me use 2FA as much as possible on personal data.
- orionblastar 11y ago2FA is nice unless you lose your cell phone or it gets stolen. If you ever lose your job or go homeless and can't afford a cell phone then you are locked out of your accounts. I am disabled and struggling if I miss payments I go homeless or can't pay my bills and things get shut off. For me 2FA might not work if I am down on my luck.
- dsmithatx 11y agoThere are ways around this for some things but, probably not with services like Facebook. For example with Amazon I use 2FA with a cellphone. As a backup I use a hardware token and an Admin account. If my cellphone gets stolen I pull the 2FA card out of my wallet.
- orionblastar 11y agoProvided that nobody steals your wallet and you don't lose that card.
- Pharaoh2 11y agoIn that case you use the backup codes that you had printed and put in a safe a register a new 2FA token.
- noobie 11y agoWhen setting up Google Authenticator for One Time Passcodes, you are also given a seed which can be used to resteup the app from another device.
- orionblastar 11y agoProvided you don't lose that seed. If I end up homeless will lose all my stuff and limited to library access. You have to plan for the worst case scenarios with 2FA when things go bad.
- noobie 11y agoWell at a certain point getting locked out stops being 2FA's fault and is simply due to the user's lack of responsibility.
- ladzoppelin 11y agoAuthy is really good. https://www.authy.com/ https://www.authy.com/ They need a Firefox extension but its allowed me to do 2FA on my personal and work accounts without fear of being totally locked out if I loose my phone.
- ladzoppelin 11y agoAuthy is really good. https://www.authy.com/ https://www.authy.com/ They need a Firefox extension but its allowed me to do 2FA on my personal and work accounts without fear of being totally locked out if I loose my phone.
- TACIXAT 11y agoI recently bought the cheapest phone I could find for 2FA. 10$ phone and 20$ minutes. It equated for 400 texts with a time limit of 3 months. I didn't do too much research but there are probably some that don't expire. So, if you ever find yourself in a tough spot, 30$ can get you access. If you ever can't afford 30$, get in touch and I'll send you a phone.
- ec109685 11y agoFacebook likely makes the challenge harder if there is no history on the device you are trying to reset your password on.