I have two factor authentication. I understand that by using a keylogger an attacker can bypass that authentication.

However I think that if I check regularly on saved logins or past logins I will see unusual activity. Then I can assume that my account is not pwned. Am I wrong?

How can an attacker bypass that mechanism?

  • 2
    If you give -1 please comment. I want to learn and I want to know what I'm wrong – MSD561 Jul 9 '16 at 14:51
  • @Jedi if you have a keylogger then they can use the code to login. I'm worried about full pwnage of computer. – MSD561 Jul 9 '16 at 15:11
  • 1
    You are confusing and combining account and system compromise. Can you narrow in on one or explain how they are tied? – schroeder Jul 9 '16 at 15:19
  • @Jedi I modify the tag. But let say that keylogger is supervised by a human which can action if necessary. – MSD561 Jul 9 '16 at 15:19
  • @schroeder i want to know if somebody can bypass my 2FA without to find out. I doesn't matter if he has or not the control of my computer. – MSD561 Jul 9 '16 at 15:21

The way a keylogger can defeat 2FA is if the attacker is in the middle and logs in for you. If this happens, you will not see unusual activity, you will see logins exactly when you logged in, but perhaps not from your location (if your account logs that). A captured 2FA code is only useful for a few seconds.

What MIGHT happen, is that the 2FA protection will be turned off in your account settings for a particular device or IP that you do not own, giving the attacker free access. Then you might see those logins.


Assuming the site/service does not provide the ability to remove activity then reviewing activity is, in my opinion, the best way to ensure account safety. Obviously this is dependent on the criteria of what appears is held and presented in the history.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.