3 ms·
I just discovered a mission critical bug in their 2FA flow as well. Gist of it is if you switch phones, verifying the new number, it still prompts to the old nu
by ArtWomb 7y ago
I just discovered a mission critical bug in their 2FA flow as well. Gist of it is if you switch phones, verifying the new number, it still prompts to the old number. You cannot login to update to the new number, without the old number. It then locks you out of your account for hours.
The kicker is I am authenticated on the new phone! But cannot make changes because of the 2FA bug. So at some point, randomly, it decided to revert to an old phone number. Even though I am certain I disabled it!
I feel even submitting a detailed report, it would take quite a while to pierce the layers of bureaucracy and come into contact with a technical human that can diagnose and understand the nature of this issue ;(
- kd913 7y agoThis is on purpose, otherwise anyone can just register a new phone including an attacker. In these contexts, you should have a recovery mechanism in place such as recovery codes or a recovery email.