Facebook uses two-step authentication or "login approval", which means that all unrecognized devices will have to enter a code received through SMS. Suppose my Samsung device is the only device that has been logged in to my Facebook account. What must the attacker do so that:

  • I won't receive any SMS (or at least won't see any)
  • I don't receive any e-mail about that
  • The attacker gains access to my account and can view messages/be active (liking, commenting)

What is the most realistic and possible scenario?

1 Answer 1


There are different possibilities from the top of my head:

  • the identifier of a legitimate device has been compromised (by a MITM with a downgrade attack, for example) and used to identify as such device,
  • the mobile phone has been compromised as a whole (forwarding and hiding/deleting SMS and emails),
  • SS7-based attack on your mobile number in combination with a compromised email account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .