News for hackers. Stuff that matters.

A comment on Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol. Parent comment

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by tqkxzugoaupvwqr on Thursday May 04, 2017 @02:15PM (#14267276)
Typically, you are asked to print out backup codes when you enable 2FA. In addition, you could copy these backups codes into your password manager and sync your password file with multiple devices, so whenever one device is gone you can access all your passwords, including 2FA backup codes from other devices.
[ Parent | on HN ]
Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by stouset on Thursday May 04, 2017 @07:27PM (#14269795)
If these backup codes are in your password manager, you're effectively* back to 1FA. Same with putting the TOTP seed into it.

* Yes, technically you need the 1Password file as well. But someone who compromises your machine will get access to both. Or if you have it synced to your phone and both are unlocked with a fingerprint, all someone needs is your device and a little effort to fool the fingerprint sensor.

[ Parent | on HN ]