|
| Authored by: Anonymous on Saturday, May 25 2013 @ 03:24 PM EDT |
The issue is not that the SMS goes to your phone, but that the
hacker can replace your phone number with their phone
number, without you knowing anything about it, until it is too late.
I can't find anything about two-step authentication on the Twitter
account I just logged into. :(
>doesn't Twitter or whoever use SSH logins, encrypted, with a
password? Wouldn't that work.
In theory, yes. The issue here is that social engineering is so
common, that it has become trivial for third parties to determine
your password, and pass themselves off as you.
With two-factor authentication, a token is sent out of band, and
received by a device that is under the exclusive control of the user
that wants to sign in.
The problem with this approach, is when the device is not under
the control of the user, but under the control of a third party.
Translating that to Twitter, and most other sites, if a third party can
login into the account, they can configure two-step
authentication, and use that to lock the legitimate user out of the
account.
Google has an interesting twist on minimising that possibility. If the
user logs in from a place that is, for the specific user "unusual",
the
screen asks the user where they usually login from. If you usually
login from Decatur, GA, writing Atlanta, GA, is usually treated as
a wrong answer. You get one or two tries to write the correct
answer, before the connection is closed. On subsequent attempts
to login, even more questions are asked, whose answers are, in
theory, something that only the legitimate user would know. (Two
of the questions are "who sends you the most email?" and "Who
do you send the most email to?" How fuzzy the answer is allowed
to be, appears to depend upon how much email one sends, and
receives. Regardless, if you provide the wrong answer to both
questions, you will be denied access to your account.)
[ Reply to This | Parent | # ]
|
| |
| Authored by: Anonymous on Saturday, May 25 2013 @ 04:20 PM EDT |
Twitter 2FA broken by design
The
PCMag article also links to a video by the boss of Toopher
[ Reply to This | Parent | # ]
|
|
|
|
