Two billion email addresses were exposed

Re:Two billion email addresses were exposed by eimrine on Friday November 07, 2025 @07:58AM (#45845881)

How is it possible to have compromised password but not compromised the second factor? I don't understand the theory of leaking not enough factors. What is stopping webmasters from using 100FA?

[ Parent | on HN ]

Re:Two billion email addresses were exposed by smsm42 on Sunday November 09, 2025 @09:41PM (#45871749)

> How is it possible to have compromised password but not compromised the second factor?

Server-side (assuming weak password storage or weak in-transit encryption) or phishing (more advanced phishers may get the codes too but only single instance of the code, not the base key).

> What is stopping webmasters from using 100FA?

The users would hunt them down and beat them mercilessly?

[ Parent | on HN ]

Re:Two billion email addresses were exposed by eimrine on Tuesday November 11, 2025 @12:18PM (#45890067)

So 2FA is a protection against the server's admin? Not even the user's protection but the webmaster's one?

[ Parent | on HN ]