News for hackers. Stuff that matters.

A comment on 49% of workers, forced to change passwords, reuse same one with minor change. Parent comment

Re:49% of workers, forced to change passwords, reuse same on... by ec109685 on Saturday December 14, 2019 @02:13AM (#21788257)
If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process.

So while you are logged in, the attacker can do anything they want.

[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by cm2187 on Saturday December 14, 2019 @03:01AM (#21788391)
The signature of the QR code would need to be accepted by your mobile, not the public computer. I don’t think mitm the QR code process is possible if they sign it. But if the public computer is compromised, anything you log into from that computer is accessible by the attacker anyway, as long as the session is valid.
[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by tomp on Saturday December 14, 2019 @05:18AM (#21788753)
That’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device
[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by ec109685 on Saturday December 14, 2019 @09:42PM (#21794111)
Yeah, agreed.
[ Parent | on HN ]