Kendimi güvende hissettiğim İki Faktörlü Doğrulama işi de en azından sms için yalan oldu gibi
Kodlara gerçek zamanlı olarak, doğrulama kodlarını sms olarak gönderen aracı firmaların veritabanlarında metin olarak saklanmasından dolayı, rahatça ulaşılmış.
San Fransisco kaynaklı bir şirket ve sızıntı ama bir sürü önemli şirket, kodlarını ulaştırmak için kullanıyor gibi görünüyor.

We found a password sent in plaintext to a Los Angeles phone number by dating app Badoo;
Several Booking.com partners were sent their six-digit two-factor codes to log in to the company’s extranet corporate network;
Fidelity Investments also sent six-digit security codes to one Chicago Loop area code;
Many messages included two-factor verification codes for Google accounts in Latin America;
A Mountain View, Calif.-based credit union, the First Tech Federal Credit Union, also sent a temporary banking password in plaintext to a Nebraska number;
We found a shipping notification text sent by Amazon with a link, which opened up Amazon’s delivery tracking page, including the UPS tracking number, en route to its destination in Florida;
Messenger apps KakaoTalk and Viber, and quiz app HQ Trivia use the service to verify user phone numbers;
We also found messages that contained Microsoft’s account password reset codes and Huawei ID verification codes;
Yahoo also used the service to send some account keys by text message;
And, several small- to mid-size hospitals and medical facilities sent reminders to patients about their upcoming appointments, and in some cases, billing inquiries.
https://twitter.com/arstechnica/status/1063540721171529729
#SiberGüvenlik #2FA #ikifaktörlüdoğrulama