3 ms·
Vulnerability in their 2fa or did @jack just not have it turned on?
by tylerjaywood 7y ago
Vulnerability in their 2fa or did @jack just not have it turned on?
- 0x00000000 7y agoCouldn’t he have just gotten phished?
- pabl8k 7y agoSome forms of 2FA are unphishable. If he used Authy or SMS, where you type in a code that can be intercepted in replayed within a window, yes. If he had set up a hardware key like U2F (like a yubikey), no. edit because I can't reply: for twitter you have to remove your phone number. I keep TOTP active as a backup, but might not if I had a highly followed account.
- dmoy 7y agoDoes twitter let you disable sms/authy fallback if you are using u2f? Many websites don't.
- sha666sum 7y agoOne point of 2FA is to protect from phishing.
- lallysingh 7y agoLooks like a sidestep around it using an SMS bridge that got hit with an AT&T internal breach.
- holografix 7y agoI was thinking exactly the same. Surely, surely he had 2fa on
- tempsy 7y agoTwitter has option of using 2FA with a authenticator app though if this is an ATT issue he must’ve fallen victim to a port attack and must’ve been using SMS based 2FA (which many would argue is not really 2FA at all)