Top 10 winner

Google Two-Factor Authentication Bypass

Kelsey Campbell-Dollaghan · Gizmodo · 1 November 2014

A developer lost his Instagram account despite Gmail two-factor authentication, because his mobile carrier was talked into forwarding his phone number and the attackers received the reset codes. It shows phone-based second factors inherit the weak identity checks of telecom customer support.

Record

Researcher

Kelsey Campbell-Dollaghan

Published by

Gizmodo

Date

1 November 2014

In the archive

• Ranked #7 in the 2014 Top 10 Web Hacking Techniques

Tags

• auth-bypass
• email
• case-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Kelsey Campbell-Dollaghan, first published at the original source. Preserved copies are kept so the citation survives its host.