3

According to https://techcrunch.com/2018/12/25/cybersecurity-101-guide-two-factor:

Only the legitimate site will send you a working two-factor code.

That might be true, but how would this help if you were signing in to Facebook on a fake website?

The site could use the already submitted username/password, make a login request to real Facebook, and then the code would be sent to the user's phone.

The user would then submit that code and the fake website could just forward it on to the real Facebook site.

1 Answer 1

4

The way it's worded on the article makes little sense. The legitimate site won't send you any codes, you are the one sending them.

But 2FA can protect you from sites harvesting credentials. Unless the attackers are using the capture credentials close to realtime, the stolen credentials are useless after a minute or so.

If the legitimate site uses SMS as 2FA, the attacker still can have it:

  1. User accesses the phishing site, enters his credentials.

  2. Attacker forwards the credentials to the legitimate site.

  3. Legitimate site sends the token via SMS to the legitimate user.

  4. The user receives the code, supplies token to the attacker.

Attacker now have both the credentials and the 2FA.

3
  • "The way it's worded on the article makes little sense. The legitimate site won't send you any codes, you are the one sending them." - Doesn't the site send you an sms with the code and then you input that code and send it to the site? So you both send the same code. Apr 26, 2022 at 1:04
  • 2
    The malicious site could login in the legitimate site with the credentials you just entered, the legitimate site sends you the token by SMS, the attack site asks you the code. As you just entered the credentials, you will supply the SMS too.
    – ThoriumBR
    Apr 26, 2022 at 1:56
  • "the legitimate site sends you the token by SMS" - so the legitimate site does send the code? Apr 26, 2022 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .