Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by ribosometronome on Thursday May 04, 2017 @03:14PM (#14267799)

Google will also let you move your Authenticator to a new device with access to the account from another trusted device without needing to 2FA.

So, for example, I can temporarily move Authenticator to an tablet if my phone is lost/stolen using my laptop, which is already trusted.

There are some potential security drawbacks to this but access to a trusted device seems a reasonable compromise between security and convenience.

[ Parent | on HN ]

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by sebcat on Friday May 05, 2017 @09:39AM (#14273321)

Also worth noting: Google Authenticator is just TOTP[1] (X=30, Digit=6, HMAC-SHA-1 IIRC). You can just copy the URL from the QR code and use it from whatever you like, as long as your clock is somewhat synced.

[1] https://tools.ietf.org/html/rfc6238

[ Parent | on HN ]