News for hackers. Stuff that matters.
Re:How to bypass Sprint/T-Mobile 2FA in under 5 minutes by vanburen on Monday August 23, 2021 @05:31PM (#28282245)
"24 words written on paper."

That's cool, I didn't realise it was possible to backup the webauthn secret this way.

I googled but couldn't find any documentation on how to set this up, could you let me know how you set this up?

Not being able to make backup of the Webauthn secret is why I have stuck with TOTP so far.

Re:How to bypass Sprint/T-Mobile 2FA in under 5 minutes by chris37879 on Monday August 23, 2021 @06:30PM (#28282832)
It's not exactly part of the webauthn standard. Or at least not a described part, it falls under the 'roaming authenticator' and 'backup credentials' mentioned in the spec, effectively it's a function that generates a crypto key where the key matter is the 24 randomly chosen words. It's basically just _another_ key that a service can setup and store for your, but encrypted with the secret they share with you up front in the form of those words.
Re:How to bypass Sprint/T-Mobile 2FA in under 5 minutes by wereHamster on Monday August 23, 2021 @07:28PM (#28283368)
The Ledger hardware wallet can act as a FIDO U2F (probably other hardware wallets as well). And to back up a hardware wallet you write down the 24 words…