4 ms·
Re: 2-factor auth: Couldn't the app try to login, detect the 2-factor, and ask you for that in the response?
by mod 12y ago
Re: 2-factor auth:
Couldn't the app try to login, detect the 2-factor, and ask you for that in the response?
- h43k3r 12y agoI don't know whether this will be possible or not. Would love to know that.
- Someone1234 12y agoYes it could. However it would only have 60 seconds (30 + 30 sec) to forward that to Google along with your credentials. It cannot be done via the user's browser due to forgery protection on Google's end, so a third party piece of software would have to grab the credentials including 2f code and log in using a "browser" (e.g. WebKit engine). One challenging problem is for the site to know if it should prompt you for the 2f code. It won't know until it tries to login, and it won't be able to try and login until it forwards your credentials to a third party piece of software and then gets a reply back. Even assuming this is done very fast, it could still take a few seconds, in particular if Google starts to throttle their client's IP. It would likely be easier just to target low hanging fruit (i.e. non-2F people) unless this is a targeted attack.