4 ms·
Microsoft and other services don't use 2FA for all services. I'm sure this can also be exploited to log into vulnerable service without 2FA and then being logge
by kolev 12y ago
Microsoft and other services don't use 2FA for all services. I'm sure this can also be exploited to log into vulnerable service without 2FA and then being logged, change the password.
My favorite is services that use secret challenge responses to reset passwords. Some of those "secret" questions are colors, car makes, etc., which narrows down the choices to just a few.
It's unfortunate that many idiots carry the title of "software engineer" when they completely hack basic analytical thinking and basic math skills to prevent such exploits!
- DangerousPie 12y agoAs far as I'm aware Microsoft (and presumably others) will require you to generate a one-time app password if a service does not support 2FA. And to generate that password, you need to be logged in with 2FA.
- kolev 12y agoNot everywhere. For example, Skype doesn't do 2FA neither does the Windows 8 login if you use a Microsoft Account.