If an attacker gains access to a cell phone's text messages, and that user routinely used text messages to receive 2-factor tokens can this information be used to gain further access to the persons accounts?


In the short term, the tokens obviously expire very quickly, so if your attacker has only had once off access this isn't a problem. If your attacker has live access to your phone's messages as they come in, then they can request a new token themselves and use it immediately to pass authentication before it expires.

With only a history of tokens, it is possible (with difficulty) to figure out the backing pattern that makes your authenticator unique, and predict future tokens - however the algorithms behind these systems are designed to make this impossible or infeasable without first analyzing many thousands of past tokens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.