Recent twts in reply to #kaggk6q

How Google Authenticator made one company’s network breach much, much worse | Ars Technica


WHY are these big companies treated as though they are the be all and end all of infosec? These are rookies errors they’re making, at scale.

Unfortunately Google employs dark patterns to convince you to sync your MFA codes to the cloud, and our employee had indeed activated this “feature”. If you install Google Authenticator from the app store directly, and follow the suggested instructions, your MFA codes are by default saved to the cloud. If you want to disable it, there isn’t a clear way to “disable syncing to the cloud”, instead there is just a “unlink Google account” option.

⤋ Read More

Wow !!! 😱 Those sneaky little shitheads!!! Google are unconspicious lying sons of notches 😢 When da fuq did they sneak this feature in?! I didn’t even notice this was a thing from a recent upgrade of the app (Authenticator) 🤦‍♂️

⤋ Read More


Also kind of curious how syncing to Google servers made this attack worse? Not that clear from the article 🤔

As I understand it: The attacker was able to compromise the Google account of that employee. That would have been pretty been in and of itself. Due to this horseshit “sync” feature, though, the attacker was also able grab all those TOTP seeds that can be used to log in to other sites.

What’s unclear to me is how the attacker got to the first factor (probably a normal password). That was probably fished separately? And/Or that employee used the same password everywhere? 🤔

⤋ Read More


Login to join in on this yarn.