News for hackers. Stuff that matters.

A comment on Google: Security Keys Neutralized Employee Phishing. Parent comment

Re:Google: Security Keys Neutralized Employee Phishing by vxNsr on Monday July 23, 2018 @12:34PM (#17593828)
Yes I can't find the articles now but there are reports of phishers using this technique to get around 2FA over SMS.
[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by SpaethCo on Monday July 23, 2018 @12:48PM (#17593946)
They got around 2FA over SMS because a number of services like GMail offered password reset via SMS as well as 2FA over SMS.

It was the password reset process that was the most vulnerable, and strangely the part that kept getting glossed over when people reported on the takeover incidents.

[ Parent | on HN ]