3 ms·
How did they know your email password and phone number at the same time?
by bitcoinmoney 7y ago
How did they know your email password and phone number at the same time?
- sfteus 7y agoThe main e-mail they targeted was included in several breaches, specifically of note the CafePress and Yahoo breaches, but various others as well. I would wager they just compiled data from each until they found something that worked.
- r1ch 7y agoA scary amount of services will let you reset a password over SMS.
- sfteus 7y agoEven more scary with the Yahoo account in particular, I have it set up as an app-based authentication, so I get a popup on my phone if someone tries to log in. However, when they (I assume) clicked the "I don't have access to this, send an SMS instead" message, that notification immediately disappeared, so I didn't even have time to hit the "don't allow" button before it was no longer an option. Google at least seems to have this right, in that when they attempted to do the same with those, the notification was still there. I also received a separate "request to reset account password" which stated it would take like 15 days to occur, and I was given the option to cancel it. Regardless, I think I'm going to try to go hardware key with an TOTP app backup for 2FA going forward, wherever possible.