How to bypass Sprint/T-Mobile 2FA in under 5 minutes

Re:How to bypass Sprint/T-Mobile 2FA in under 5 minutes by lrvick on Tuesday August 24, 2021 @07:26AM (#28287353)

As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction.

Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for.

In a typical implementation someone must be present at the machine expecting a tap, and tapping.

That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.

[ Parent | on HN ]

Re:How to bypass Sprint/T-Mobile 2FA in under 5 minutes by UncleMeat on Tuesday August 24, 2021 @08:23AM (#28287862)

If malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.

[ Parent | on HN ]