2 ms·
Apart from SMS as a second factor, what's this with "What number would you like me to send this [code] to?", where clearly an attacker could give an arbitrary b
by FabHK 5y ago
Apart from SMS as a second factor, what's this with "What number would you like me to send this [code] to?", where clearly an attacker could give an arbitrary burner number under their control. They should only use numbers already associated with the account, and adding/changing one should by itself require authentication. Oh well.
- chrischen 5y agoThey send it to a number on the account.
- FabHK 5y agoSo the question is in case there are multiple numbers associated with the account?
- lotsofpulp 5y agoIt is common to be part of a family plan in the US. The person in the example must have been in one to have been offered that option. Family plans are much cheaper per phone number than individual plans.
- dylan604 5y agoDepends on the account type. I have had Microsoft and other systems ask me to send a code to a phone number. It wasn't specific, so I asked my co-worker if, for science, I could send the code to their phone. It worked.