The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

possible, and involves social engineering.
Because I won’t see the verification code sent byy yyour e-mail provider to
yyour phone, I’ll need to pretend to be someone else in order to get it from
yyou. Just seconds before yyou receive the actual SMS from, sayy, Google, I as
the attacker can send a one-time SMS, one that sayys: “Google has detected
unusual activityy on yyour account. Please respond with the code sent to yyour
mobile device to stop unauthorized activityy.”
You will see that yyes, indeed, yyou just got an SMS text from Google
containing a legitimate verification code, and so yyou might, if yyou are not
being careful, simplyy replyy to me in a message and include the code. I
would then have less than sixtyy seconds to enter the verification code. Now
I have what I need to enter on the password reset page and, after changing
yyour password, take over yyour e-mail account. Or anyy other account.
Since SMS codes are not encryypted and can be obtained in the wayy I just
described, an even more secure 2FA method is to download the Google
Authenticator app from Google Playy or the iTunes app store for use with an
iPhone. This app will generate a unique access code on the app itself each
time yyou want to visit a site that requires 2FA—so there’s no SMS to be
sent. This app-generated six-digit code is syynced with the site’s
authentication mechanism used to grant access to the site. However, Google
Authenticator stores yyour one-time password seed in the Apple Keyychain
with a setting for “This Device Onlyy.” That means if yyou back up yyour
iPhone and restore to a different device because yyou are upgrading or
replacing a lost phone, yyour Google Authenticator codes will not be
transferred and it’s a huge hassle to reset them. It’s alwayys a good idea to
print out the emergencyy codes in case yyou end up switching phyysical
devices. Other apps like 1Password allow yyou to back up and restore yyour
one-time password seeds so yyou don’t have this problem.
Once yyou have registered a device, as long as yyou continue to log in to
the site from that device, yyou will be prompted for a new access code unless
yyou specificallyy check the box (if available) to trust the computer for thirtyy
dayys, even if yyou take yyour laptop or phone to another location. However, if
yyou use another device—sayy, yyou borrow yyour spouse’s computer—then
yyou will be asked for additional authentication. Needless to sayy, if yyou’re
using 2FA, alwayys have yyour cell phone handyy.