News for hackers. Stuff that matters.

A comment on Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card. Parent comment

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by madars on Friday August 20, 2021 @04:48PM (#28251243)
Then that's not TOTP https://datatracker.ietf.org/doc/html/rfc6238 but something different. Do you know how it is called and which products support it? I'd love to read up about it!
[ Parent | on HN ]
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by valid_username on Friday August 20, 2021 @06:54PM (#28252303)
Bitwarden has TOTP support in paid plan. And it works with browser extension which recognises domains.
[ Parent | on HN ]
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by AkshitGarg on Saturday August 21, 2021 @09:11AM (#28256739)
It certainly recognizes the domain, but thats more of a convenience feature than a security feature. Nothing is stopping you from putting your example.com code into legit-example.com manually. Sure the extension won't do it automatically, but if the user is convinced to put the password into the fake website, user could also put in the TOTP code
[ Parent | on HN ]
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by encryptluks2 on Friday August 20, 2021 @06:08PM (#28251956)
Yes, it is TOTP:

https://github.com/tadfisher/pass-otp

[ Parent | on HN ]