4 ms·
This is scarily simple. Profit indeed for a black hat. Coupled with a recent post about Gmail on how phone carriers are the weakest link, I just don't feel safe
by phreack 10y ago
This is scarily simple. Profit indeed for a black hat. Coupled with a recent post about Gmail on how phone carriers are the weakest link, I just don't feel safe with anything but a dongle based 2fa these days.
- tmzt 10y agoUnless the master key is compromised allowing anyone to generate authenticator codes, as I seem to recall happened a few years ago with a major provider.
- jlgaddis 10y agoI think you're referring to RSA's SecurID? That was roughly five years or so ago.
- vinay427 10y agoThat doesn't help in this case. I have a VeriSign 2FA dongle for PayPal and it still offers the same option of logging in with security questions.