3 ms·
2FA doesn’t protect against phishing because the phisher can just create a form for the 2FA code and the victim, who already trusts the phishing page because th
by quantumwannabe 5y ago
2FA doesn’t protect against phishing because the phisher can just create a form for the 2FA code and the victim, who already trusts the phishing page because they’ve already typed in their username and password, will give it to them.
2FA protects against attacks like trying passwords from a hacked database on other accounts with the same username.
- RL_Quine 5y agoThe exception is U2F, which binds the key to the domain name to prevent pass through attacks.
- joshka 5y agoIt shouldn't be... This is why HSMs exist. See https://www.rfc-editor.org/rfc/rfc4226#section-7.5 https://www.rfc-editor.org/rfc/rfc4226#section-7.5 and https://www.rfc-editor.org/rfc/rfc4226#section-9 https://www.rfc-editor.org/rfc/rfc4226#section-9 for bidirectional authentication