3 ms·
I'm not sure what you mean, unless they have access to my 2FA app how can they get access to my codes?
by worble 4y ago
I'm not sure what you mean, unless they have access to my 2FA app how can they get access to my codes?
- bdsa 4y agoBy setting up a dummy login screen that you unwittingly enter a valid code into (which I believe is the current best guess for how it was achieved in this case.)
- SargeDebian 4y agoSome corporate 2FA apps send a push notification to a mobile device. Because of how that is set up, it doesn't always (A) show what the login is for because it shows the name of the SSO app instead of the actual application, (B) show other correct data, e.g. if the user is on a VPN, the location may be the VPN endpoint because of IP-address based locations, and (C) it doesn't always show on the user's device that a login needs to take place, because it may be an Exchange connection refreshing periodically in the background So, some people just accept whatever pushes they get.
- sp332 4y agoSee this screenshot https://mobile.twitter.com/GossiTheDog/status/1570717994397073410/photo/1 https://mobile.twitter.com/GossiTheDog/status/15707179943970...