After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account.

Consider an attacker does session hijacking. Can attacker access to Gmail account if attacker uses hijacked session? Or he will stop at entering verification code?

UPDATE: Attacker does session hijacking after user enters verification code.

  • he may hijack after code verification (If we consider that).
    – Akam
    Apr 24, 2014 at 16:56
  • @Akam I updated post. Apr 25, 2014 at 6:46

2 Answers 2


Short answer: Yes, the attacker can use session hijacking.

Long answer: attackers can use XSS to get your browser cookie (the one that Google sets) and inject it into their request for Google. Still, if that doesn't happen, malware can do whatever it wants while you are logged in.

  • The original post has 3 different questions, what's the "Yes" responding to? :)
    – Joel L
    Apr 25, 2014 at 11:15
  • @JoelL - Can the attacker access your account if he does session hijacking
    – anonman
    Apr 25, 2014 at 16:19
  • (You should update your answer so it's clear what you're saying)
    – Joel L
    Apr 26, 2014 at 10:17

Multifactor authentication requires having 2+ of the following:

  • Something you know (e.g., secret like a password)
  • Something you have (e.g., token or code provided to specified device)
  • Something you are (biometrics)

(Also note there are new concepts for multi-factor, but these are the base ones for MFA)

Google is using a system where you have a password and by using a one time code/pin (OTP). This means that someone cannot log into your account without knowing the code, but doesn't mean they can't hijack your session. If they are have compromised your workstation, network, or browser, then they are seeing everything you input, including this pin. This could be via a classic man-in-the-middle or a man-in-the-browser attack.

Security needs to be applied in layers, so the two-step logon provides one component, but its not an absolute assurance or silver bullet. The attacker cannot log in without the code, so if they want to log in, they either need to compromise your phone directly (malware or authorized malicious app which can read text messages), compromise your computer so they can just manipulate the running code or forward the code to an attacker when you type it in, or compromise you through social engineering (e.g., they convince you to forward the code via SMS under some pretext).

So, it makes it a lot harder to compromise your account, but not impossible. i.e. - If your phone is turned off, they would have a hard time. If your phone was off and was not compromised, and you didn't enter it into the computer they would have a hard time. There are some remaining edge cases (e.g., they doing some phreaking to intercept your SMS), but generally its an upgrade in the security of your account.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .