News for hackers. Stuff that matters.

A comment on 1Password and 2FA: Is it wrong to store passwords and one-time codes together? (2023). Parent comment

Re:1Password and 2FA: Is it wrong to store passwords and one... by adastra22 on Saturday July 06, 2024 @05:30AM (#40889247)
I don't see those as realistic. Session interception largely isn't a thing anymore, unless we're talking about nation-state levels of attackers, and if the service is storing your password unhashed then I sincerely doubt their 2FA is configured in a secure way anyway.
[ Parent | on HN ]
Re:1Password and 2FA: Is it wrong to store passwords and one... by jackweirdy on Saturday July 06, 2024 @06:59AM (#40889612)
I think it’s not a nation state actor thing. In 2018 British airways checkout got popped by a JavaScript being library being changed to eavesdrop credit cards. The same thing could easily happen with password forms

Granted they didn’t break the session in flight, but there is a low bar to achieve the same thing

[ Parent | on HN ]