5 ms·
2FA adds more value than that - it’s meant to be about “something you know and something you have” (in theory, physically). That way, even if your password is c
by timwis 5y ago
2FA adds more value than that - it’s meant to be about “something you know and something you have” (in theory, physically). That way, even if your password is compromised three something like a data breach, you’re still protected.
- bawolff 5y agoIf the server in question is data breached, than they'll steal the 2FA secret. If the user's cell phone is breached, they will steal both the 2fa token and the password (or just the session cookie). Well what you say is true in theory, its not true in practise of how 2FA is commonly implemented.
- timwis 5y agoGood point, but wouldn’t they also need the time based algorithm? Here’s some more ammunition for your argument though: https://www.csoonline.com/article/3272425/11-ways-to-hack-2fa.html https://www.csoonline.com/article/3272425/11-ways-to-hack-2f...