News for hackers. Stuff that matters.

A comment on Tell HN: SMS-based two-factor authentication is not secure. Parent comment

Re:Tell HN: SMS-based two-factor authentication is not secure by rocqua on Wednesday June 09, 2021 @10:00AM (#27447910)
Its generally not "second factor authentication" but 2-factor authentication. The idea is that you have 2 separate authentication factors. Preferably both with decent security.

Besides, I don't believe coinbase does SMS only account recovery. So here SMS really did fail as a second factor. Since it seems attackers must have had a password and SMS. (I am not 100% on the coinbase account recovery process)

[ Parent | on HN ]
Re:Tell HN: SMS-based two-factor authentication is not secure by cortesoft on Wednesday June 09, 2021 @11:27AM (#27449040)
No, it sounds like coinbase used email recovery, but his email provider used SMS recovery.

So the hacker only needed to hijack his SMS.... with that, they gained access to his email, and then with that gained access to coinbase. No password required.

[ Parent | on HN ]