News for hackers. Stuff that matters.

A comment on Reddit Security Incident. Parent comment

Re:Reddit Security Incident by DennisAleynikov on Wednesday August 01, 2018 @04:10PM (#17666488)
TOTP clients cannot be intercepted where as sms tokens can be compromised in a variety of ways.
[ Parent | on HN ]
Re:Reddit Security Incident by whitepoplar on Wednesday August 01, 2018 @08:48PM (#17668406)
TOTP tokens can absolutely be intercepted. A MITM attack can work like this:

1) User inputs username and pw into spurious site.

2) Spurious site prompts for the user's TOTP token.

3) Spurious site proceeds to immediately log in to the real site w/ username, pw, and valid TOTP token.

4) Bad guys get an HTTP session cookie which for many sites lasts practically indefinitely.

[ Parent | on HN ]