2 ms·
Unless the second factor is U2F, because the actual domain is handed to the U2F dongle by the browser and the authentication is tied to that.
by makomk 10y ago
Unless the second factor is U2F, because the actual domain is handed to the U2F dongle by the browser and the authentication is tied to that.
- laurencei 10y agoThanks - good point :) But for the Google Authenticator and SMS - it would still be vulnerable.