Two Factor Failure
summary
Claims that many 2FA deployments are undermined by real-world design and operational mistakes: a practical TOTP (RFC 6238) attack leverages paired phones and unprotected device backups (iOS 7 backups often expose keys), SMS/call paths are defeated by SMS forwarding via Google Voice and malware that harvests messages, and bolt-on 2FA leaves recovery/internal APIs unprotected. Demonstrations include malware-based SMS theft, examples of API bypasses against PayPal/Google-style flows, and recommendations like transaction-confirmation hardware tokens and client-protected storage.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 1:19History of authentication
- 3:12Evolution to soft tokens
- 4:59PCI standards and SMS risks
- 7:13Malware and smart card threats
- 9:15Biometric authentication issues
- 10:45Compromising paired devices
- 13:17Vulnerabilities in APIs
- 16:44Future of secure auth
- 22:02Client certificates and Q&A
