Disabling Google 2FA doesn't need 2FA if you're already logged in

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by CodesInChaos on Friday July 10, 2020 @12:17PM (#23793058)

If the compromise of the machine could be turned into a permanent compromise) with the ability to manipulate the UI (which seems likely on mainstream Desktop OSs, you could use that to intercept the 2FA token on the next login, and use it to turn off 2FA.

The only way to prevent that would be making the token purpose bound, and displaying that purpose on the trusted 2FA device.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by coder543 on Friday July 10, 2020 @12:21PM (#23793113)

Or by using a U2F device, which is designed to prevent spoofing.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by frei on Friday July 10, 2020 @12:43PM (#23793372)

U2F doesn't protect you from an untrusted machine, it protects you from untrusted websites.

https://security.stackexchange.com/questions/157756/mitm-att...

The security model relies on the browser validating the origin.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by CodesInChaos on Friday July 10, 2020 @12:51PM (#23793478)

I don't think there is a way around "displaying that purpose on the trusted 2FA device." if you want to protect against a compromised computer.

Domain binding protects you from fishing, but still relies on the user's computer, including the browser, being secure. So it doesn't help here.

[ Parent | on HN ]