4 ms·

Not if the phising site asks for the 2FA token.

• userbinator 9y ago
  The point of 2FA is challenge-response and the secret key is in the token. If a phishing site asks for 2FA it can get only one valid challenge-response pair, not the secret key.
  • deleted 9y ago
    [deleted]
  • joshuamorton 9y ago
    That still allows them to log in though.
  • Gaelan 9y ago
    One login is enough to authorize an Oauth app.
    • ReverseCold 9y ago
      Require second login to transfer chrome apps to alternate account + 24 hour timer on transfer that sends an email to recovery email/everyone else relevant when extension is transferring.
  • Buge 9y ago
    SMS and TOTP (Google Authenticator) can both be phished. U2F cannot be phished.
    • TeMPOraL 9y ago
      Can't it? What if I control the user's computer and can let my own code interact with U2F? Or does the protocol somehow prevent that?
      • deleted 9y ago
        [deleted]
      • Buge 9y ago
        If you control the user's computer, that isn't phishing. That's keylogging/credential theft.