3 ms·
Your edit is correct. And the Google Voice instructions posted at the above link right now are clear: you do not need to interact with your old carrier to get
by jzwinck 12y ago
Your edit is correct. And the Google Voice instructions posted at the above link right now are clear: you do not need to interact with your old carrier to get your number on Google Voice. I have tried it myself.
I believe what I outlined turns "Something you know and something you have" into "Something you know and something you once had for a minute at a different point in time." This is a significant to the 2FA security model, because the victim may mistakenly believe that even when left alone with her phone, especially if the phone requires a code to access (which is often not needed to answer a call), you would not be able to take control of her accounts unless you were simultaneously using a computer to do so. All you need is to click the "Verify" button on your Google account at the right time, which would likely go unnoticed.
- jameshart 12y agoBut all 'something you have' authentication is vulnerable to the theft of the 'something you have' - your attack is just a slightly more sophisticated version of stealing the phone. I don't think it's particularly relevant to the use of a phone as a 2fa device.