24 ms·
That's not true for SMS-2FA, since text messages are often delivered to the device with the browser. Safari on both macOS and iOS will offer to automatically fi
by electrum 6y ago
That's not true for SMS-2FA, since text messages are often delivered to the device with the browser. Safari on both macOS and iOS will offer to automatically fill in the code received from SMS.
- miohtama 6y agoBut it is true for Windows PCs that represent more than 90% of compromised devices.
- PopeDotNinja 6y agoThat would be consistent with ~90% marketshare, wouldn't it?
- benibela 6y agoMy Windows/Linux laptop has a SIM card slot But I do not use it because of risk of getting 2FA compromised :/
- valuearb 6y agoI am curious as to how Safari connects the 2FA code to the web page. It would seem whatever they are doing could easily implement a database that maps 2FA SMS messages to domains, not only refusing to auto enter them on phishing sites; but warning the user they may be on one.
- ThePowerOfFuet 6y agoIt doesn't; it offers to autofill a received code into a field on the page for a short time, but only actually fills it upon user interaction (so the page can't be sniffing for it via JS the moment it arrives).