Collaborate Disseminate
I was being harassed by a phone number, and when I tried to get details about it from the company whose SIM was being used, they said that the number is not registered with them. The company also mentioned that the number might be using a … Continue reading I want to know about some techniques to get phone number information
I’m adding 2FA to my app and have set it up for users who have registered with email. I also have users who log in with Facebook and others who use their mobile number.
Should I also add TOTP for users who log in with Facebook, or is that … Continue reading Do I need to add TOTP 2FA for Facebook and mobile number logins in my app?
I have dedicated a VOIP number for 2fa use. What are some reasons why it would be safer or less safe than using a cell phone?
I am using a number from didforsale.com. They forward all SMS messages to my email address which is hosted, using… Continue reading Is using a VOIP number for 2fa safer or less safe than using a cell number?
On August 2, 2023, the Microsoft security blog presented this scenario, in which the protection normally afforded by number-matching MFA on MS Authenticator can be thwarted:
In this activity, Midnight Blizzard either has obtained valid ac… Continue reading Is MS number-matching MFA still amenable to bypass in this scenario?
On August 2, 2023, the Microsoft security blog presented this scenario, in which the protection normally afforded by number-matching MFA on MS Authenticator can be thwarted:
In this activity, Midnight Blizzard either has obtained valid ac… Continue reading Is MS number-matching MFA still amenable to bypass in this scenario?
The Microsoft account can have multiple ways to prove who you are for 2FA (two-factor authentication).
When you forget your 2FA security info you can initiate the account recovery process by clicking "Forget password?".
The recov… Continue reading Bypass Microsoft Account 2FA
According to different pages (e.g. OneIdentity, also a Google Security source I can’t find anymore), using Passkeys does count as Multi Faktor Authentication. To my understanding, they argue, that the User needs
the device,
and needs to b… Continue reading Passkeys: MFA or not?
Websites ask for passwords to ensure you are the account owner before you make changes to high-risk settings, but autofill works all the time, even when the browser is in Incognito mode.
If someone already has access to your computer, it d… Continue reading How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?
user have a verified email in system A
user have a verified phone number system A
user’s authentication method in system A is out of scope in this question, but it is password based
security measures of system A is out of scope in this qu… Continue reading Is the following considered 2FA?
Is there a name for this kind of attack against Multi-Factor Authentication:
Attacker is in possession of a user login and password, and is able to trigger a transaction or login which requires MFA authentication by the legitimate user. M… Continue reading Attack against MFA: attacker triggering MFA prompt at the same time user is doing a legitimate transaction requiring MFA