Bernard Sheppard on Nostr: Yeah, OFA was half in jest - but you don't even need to know the account number or ...
Yeah, OFA was half in jest - but you don't even need to know the account number or username: if you have a list of emails and phone numbers, and get control of one of those email accounts, and you were a bad actor, you would be crazy not to at least attempt to log in: you need no other factor. You don't need the thing you know (the password) and the thing you have (the phone) for the 2FA. The email as a factor is sort of there, but only just.
The assumption is that every customer controls their accounts at all times.
Published at
2024-04-10 10:31:51Event JSON
{
"id": "67504c1cb5834f6877965e7a3c0ed82cec9d163bf99ea2b4b01343dcea36f22f",
"pubkey": "31cc78a689b792b2dc81d909a565ab0dbb06bf764c4ee74e99793281dafee819",
"created_at": 1712745111,
"kind": 1,
"tags": [
[
"e",
"3162c57d161a1f2c3daa786863220f227b2bd32e5432f2e8f99fca75e7439b52",
"",
"root"
],
[
"e",
"2078c536f1df8d7d8bbc6982316e48d786b818422cf50013ab432629ab83312d",
"",
"reply"
],
[
"p",
"31cc78a689b792b2dc81d909a565ab0dbb06bf764c4ee74e99793281dafee819"
],
[
"p",
"d84b86258bf9a00a524202aa2e5a9cf63bfb078c4c830f30aeca555210377cb1"
],
[
"proxy",
"https://mastodon.au/users/BernardSheppard/statuses/112246463634338501",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.au/users/BernardSheppard/statuses/112246463634338501",
"pink.momostr"
]
],
"content": "Yeah, OFA was half in jest - but you don't even need to know the account number or username: if you have a list of emails and phone numbers, and get control of one of those email accounts, and you were a bad actor, you would be crazy not to at least attempt to log in: you need no other factor. You don't need the thing you know (the password) and the thing you have (the phone) for the 2FA. The email as a factor is sort of there, but only just. \n\nThe assumption is that every customer controls their accounts at all times.",
"sig": "7c96c91a8ce2492800c62d4e731d61262e8308f71c6e82cba866138779537afb449af811178763dd78eab1ced64d6a14d2f23f9322ae8f43f3129cbb68ff63fa"
}