3 ms·
This is the same as the Google Authenticator app that people are talking about.
by smackfu 14y ago
This is the same as the Google Authenticator app that people are talking about.
- keturn 14y agoThe thing that bugs me about this model is that it's not challenge-response, so someone can play man-in-the-middle. While it's possible to hijack someone's phone number, as demonstrated, it requires a relatively high amount of effort per target. Whereas if you compromise a network segment somewhere (with DNS and a rogue SSL cert or whatever you need), you could just sit there, farming authentication cookies. Have your MitM check the "authenticate this computer for 30 days" checkbox and you've got a nice little collection to work with.
- cantankerous 14y agoAre you familiar with methods that are resilient in the face of MitM attacks?