News for hackers. Stuff that matters.

A comment on SMS Pumping Attack. Parent comment

Re:SMS Pumping Attack by weird-eye-issue on Monday August 07, 2023 @09:40AM (#37034304)
...

You would have to get access to their email and SMS to perform a password reset and get past 2FA. If you are saying you could do a SIM swap attack simply by having access to their email I think that is not that practical at all.

> To answer your question on whether or not people access other people's SMS accounts -- yes!

What? I never asked that? What are you even talking about?

[ Parent | on HN ]
Re:SMS Pumping Attack by rkeene2 on Saturday August 12, 2023 @04:11PM (#37103811)
It's really unclear to me why you think that email would be involved in any other capacity than 2FA in this scenario.

Are you imagining that email is used in some other additional way in the authentication process, such as account recovery ?

[ Parent | on HN ]
Re:SMS Pumping Attack by weird-eye-issue on Monday August 14, 2023 @11:22AM (#37122073)
You've never done a password reset? That goes to your email. If your 2FA is over email too then that isn't 2FA. Because you only need the email to take over an entire account
[ Parent | on HN ]
Re:SMS Pumping Attack by rkeene2 on Wednesday August 23, 2023 @12:50PM (#37238815)
So I see the problem now, your model includes a hidden assumption that password resets go to email -- this is not always the case.
[ Parent | on HN ]