3 ms·
Yeah, I wasn't trying to focus so much on SSLstrip, but rather that it's possible to get into an account that has Two-Factor enabled, and generate a OTP that wi
by neilwillgettoit 14y ago
Yeah, I wasn't trying to focus so much on SSLstrip, but rather that it's possible to get into an account that has Two-Factor enabled, and generate a OTP that will allow for sans Two-Factor logins going down the line.
- Piskvorrr 14y agoWeakest link gets attacked - and with one-factor auth still available, that is the weakest link. IMNSHO, labeling this scheme as "two-factor" is misleading - "two-factor with possible backdoor" would be more appropriate. (Also, I think that "OTP" is more commonly used to mean "one-time pad" - now that would have been more secure :))