3 ms·
Why? Their two factor authentication works just fine.
by 1SaltwaterC 14y ago
Why? Their two factor authentication works just fine.
- EthanHeilman 14y agoSomeone can just steal your two factor authentication token by asking for one at a forged login page.
- 1SaltwaterC 14y agoIt's not that easy. I use the "push" authentication model, aka Google sends me an SMS whenever I need to authenticate a device. I don't request it explicitly. The pairing is made between the authentication code, and that device. Now, if it happens that I'm stupid enough to enter my login details into a fake page, the interesting part would be the lack of SMS from the Google side, but I will get an SMS when somebody else would try the credentials. Tough break. Besides, this week's phishing attempt asked me my: name, Google account, password, recovery email address. They say that https is as secure as the user that's using it. Same goes for this stuff. device = browser profile, aka for two browsers on the same machine you need two authentication tokens. Same goes for the same browser with two profiles.